PT-2020-17251 · Duo · Duo Network Gateway

Published 2020-10-14 · Updated 2020-10-29 · CVE-2020-3483

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Duo Network Gateway (DNG) versions 1.3.3 through 1.5.7

Description The issue concerns the logging of customer-provided SSL certificates and private keys in plain-text to local files on the DNG host. This could allow an attacker with access to the DNG logs and the ability to intercept and manipulate network traffic to decrypt and manipulate SSL/TLS connections to the DNG and protected applications.

Recommendations For Duo Network Gateway (DNG) versions 1.3.3 through 1.5.7, update to a version that includes the fix for this issue to prevent certificate and private key information from being logged in plain-text.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-256

CWE-522

Related Identifiers

CVE-2020-3483

Affected Products

Duo Network Gateway

References · 3

• https://duo.com/labs/psa/duo-psa-2020-004 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3483 · Security Note
• https://osv.dev/vulnerability/CVE-2020-3483 · Vendor Advisory