The Red Hat Advanced Cluster Security (RHACS) 4.6 update addresses several security vulnerabilities, notably CVE-2024-4067, which is a Regular Expression Denial of Service (ReDoS) vulnerability in the micromatch library. Other fixed vulnerabilities include CVE-2024-24789 (incorrect handling of certain ZIP files in Golang archive/zip), CVE-2024-24790 (unexpected behavior in Golang net/netip Is methods for IPv4-mapped IPv6 addresses), and CVE-2024-39249 (ReDoS in nodejs-async autoinject function parsing). The advisory does not provide CVSS scores but classifies the overall severity as moderate. The update is available as RHACS 4.6 for various architectures including x86_64, s390x, ppc64le, and aarch64. Users of earlier versions are advised to upgrade to this release to address these vulnerabilities.

The vulnerabilities fixed in RHACS 4.6 could allow denial of service conditions via Regular Expression Denial of Service (ReDoS) attacks and incorrect processing of ZIP files or IP address methods, potentially impacting the stability and reliability of the affected components. No known exploits in the wild have been reported. The overall severity is moderate, indicating a medium risk to affected deployments if unpatched.

Red Hat advises users to upgrade to RHACS 4.6, which includes fixes for the identified vulnerabilities. Since this is a product update with security fixes, applying the updated images and versions as provided by Red Hat is the recommended remediation. No alternative mitigations or temporary workarounds are specified in the advisory.