GHSA-jf75-p25m-pw74 Coder logs sensitive objects unsanitized

• Go github.com/coder/coder/v2: < 2.26.5 → fixed in 2.26.5 • Go github.com/coder/coder/v2: >= 2.27.0, < 2.27.7 → fixed in 2.27.7 • Go github.com/coder/coder/v2: >= 2.28.0, < 2.28.4 → fixed in 2.28.4

Summary Workspace Agent manifests containing sensitive values were logged in plaintext unsanitized Details By default Workspace Agent logs are redirected to stderr https://github.com/coder/coder/blob/a8862be546f347c59201e2219d917e28121c0edb/cli/agent.go#L432-L439 Workspace Agent Manifests containing sensitive environment variables were logged insecurely https://github.com/coder/coder/blob/7beb95fd56d2f790502e236b64906f8eefb969bd/agent/agent.go#L1090 An attacker with limited local access to the Coder Workspace (VM, K8s Pod etc.) or a third-party system (SIEM, logging stack) could access those logs This behavior opened room for unauthorized access and privilege escalation Impact Impact varies depending on the environment variables set in a given workspace Patches Fix was released & backported: • https://github.com/coder/coder/releases/tag/v2.28.4 • https://github.com/coder/coder/releases/tag/v2.27.7 • https://github.com/coder/coder/releases/tag/v2.26.5 Workarounds One potential workaround is to disable Workspace Agent Logs by setting following configuration option `CODER_AGENT_LOGGING_HUMAN=/dev/null` > platform operators are advised to upgrade their deployments