CVE intelligence and bounded remediation

CVE-2020-3442 — The DuoConnect client enables users to establish SSH connections to hosts protected by a DNG instance

Medium CVSS 5.7

The DuoConnect client enables users to establish SSH connections to hosts protected by a DNG instance. When a user initiates an SSH connection to a DNG-protected host for the first time using DuoConnect, the user’s browser is opened to a login screen in order to complete authentication determined by the contents of the '-relay' argument. If the ‘-relay’ is set to a URL beginning with "http://", then the browser will initially attempt to load the URL over an insecure HTTP connection, before being immediately redirected to HTTPS (in addition to standard redirect mechanisms, the DNG uses HTTP Strict Transport Security headers to enforce this). After successfully authenticating to a DNG, DuoConnect stores an authentication token in a local system cache, so users do not have to complete this browser-based authentication workflow for every subsequent SSH connection. These tokens are valid for a configurable period of time, which defaults to 8 hours. If a user running DuoConnect already has a valid token, then instead of opening a web browser, DuoConnect directly contacts the DNG, again using the configured '-relay' value, and sends this token, as well as the intended SSH server hostname…

Severity
Medium
CVSS
5.7 (3.1)
Published
2020-07-20
CISA KEV
Not currently listed
Ecosystem
software/application
Weaknesses
CWE-319

Affected products

  • duo / duoconnect

Matched remediation archetype

Cryptography, certificate, signature, and channel validation

This catalog composition supplies bounded fallback guidance. Explicitly reviewed curated workflows load with the complete record below.

Check exposure

  • Inventory affected algorithms, key uses, trust stores, certificate validation settings, random sources, and plaintext channels across clients and services.
  • Determine which secrets, identities, signatures, or data protections depend on the affected primitive or validation path.
  • Check debug, compatibility, fallback, and hostname or audience override settings in build and runtime configuration.

Remediate safely

  • Use a maintained platform cryptographic API with approved algorithms, modes, parameters, randomness, and full peer identity validation.
  • Remove insecure fallback and validation bypasses; separate keys by purpose and load them from managed secret storage.
  • Plan rotation or reissuance for affected keys, certificates, tokens, hashes, or ciphertext and document compatibility sequencing.

Authoritative sources

Complete CVE record and remediation plan

The detailed catalog view below loads this exact record, its source evidence, and the full seven-phase agentic change plan.