The Red Hat Advanced Cluster Security (RHACS) 4.6 release introduces new features and fixes multiple security vulnerabilities, notably CVE-2024-4067, a Regular Expression Denial of Service vulnerability in the micromatch library. Other addressed vulnerabilities include CVE-2024-24789 (golang archive/zip incorrect handling of ZIP files), CVE-2024-24790 (golang net/netip unexpected behavior), and CVE-2024-39249 (nodejs-async ReDoS). The vendor advisory confirms that patches are available and recommends upgrading to RHACS 4.6. Separately, Red Hat Satellite 6.16 for RHEL 8 and 9 also fixes CVE-2024-4067 among other critical vulnerabilities, with updated packages released. The advisories provide detailed information on affected products and remediation steps.

The vulnerabilities fixed in RHACS 4.6 and Red Hat Satellite 6.16 include denial of service conditions via regular expression processing (ReDoS), incorrect handling of ZIP files, unexpected behavior in IP address methods, and other security issues that could affect system stability and security. The impact severity ranges from medium (RHACS) to critical (Satellite). Exploitation could lead to service disruption or unauthorized access depending on the specific vulnerability. No known exploits in the wild have been reported for these issues at the time of the advisory.

Red Hat has released updated images and packages for RHACS 4.6 and Red Hat Satellite 6.16 that address these vulnerabilities. Users are strongly advised to upgrade to RHACS 4.6 or later and to apply the Red Hat Satellite 6.16 updates promptly. The vendor advisory provides detailed upgrade instructions and confirms that these updates fix the identified security issues. No additional mitigation actions are specified beyond applying the official patches.