CVE-2020-3483

Name of the Vulnerable Software and Affected Versions Duo Network Gateway (DNG) versions 1.3.3 through 1.5.7

Description The issue concerns the logging of customer-provided SSL certificates and private keys in plain-text to local files on the DNG host. This could allow an attacker with access to the DNG logs and the ability to intercept and manipulate network traffic to decrypt and manipulate SSL/TLS connections to the DNG and protected applications.

Recommendations For Duo Network Gateway (DNG) versions 1.3.3 through 1.5.7, update to a version that includes the fix for this issue to prevent certificate and private key information from being logged in plain-text.