PT-2020-17251
CVE-2020-3483
·
تاريخ النشر
2020-10-14
·
تاريخ التحديث
2020-10-29
الوصف من
CVSS 3.1
7.1
عاليةالمقاييسAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions
Duo Network Gateway (DNG) versions 1.3.3 through 1.5.7
Description
The issue concerns the logging of customer-provided SSL certificates and private keys in plain-text to local files on the DNG host. This could allow an attacker with access to the DNG logs and the ability to intercept and manipulate network traffic to decrypt and manipulate SSL/TLS connections to the DNG and protected applications.
Recommendations
For Duo Network Gateway (DNG) versions 1.3.3 through 1.5.7, update to a version that includes the fix for this issue to prevent certificate and private key information from being logged in plain-text.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾