The Red Hat buildah package for RHEL 9.2 has multiple security fixes addressing four CVEs: CVE-2025-52881 (runc container escape and denial of service via arbitrary write gadgets and procfs write redirects), CVE-2025-58183 (golang archive/tar unbounded allocation when parsing GNU sparse map), CVE-2025-47913 (golang.org/x/crypto/ssh/agent SSH client panic due to unexpected SSH_AGENT_SUCCESS), and CVE-2025-65637 (github.com/sirupsen/logrus denial-of-service from large single-line payload). These vulnerabilities impact container image building and runtime components, potentially allowing container escapes, denial of service, or client crashes. The advisory provides updated buildah packages to remediate these issues for RHEL 9.2 variants across multiple architectures.

The vulnerabilities fixed in this advisory could allow attackers to cause denial of service conditions, trigger client panics, or escape container isolation boundaries. Specifically, CVE-2025-52881 enables container escape and denial of service via runc, CVE-2025-58183 allows unbounded memory allocation leading to denial of service, CVE-2025-47913 causes SSH client panics, and CVE-2025-65637 results in denial of service from large payloads. These impacts affect the security and stability of containerized environments built or managed with buildah on affected Red Hat Enterprise Linux 9.2 systems.

Red Hat has released updated buildah packages (version 1:1.29.5-1.el9_2.2) for Red Hat Enterprise Linux 9.2 that address these vulnerabilities. Users should apply these official updates promptly following Red Hat's guidance at https://access.redhat.com/articles/11258. No additional mitigations are specified or required beyond applying the vendor-provided patches.