I have heard many times over the years that Google does not crawl/index secure pages... however, when performing a inURL:https search in Google you will see that this is certainly NOT true; they not only crawl, they index. So, if it is being crawled and indexed I would say there is a very real chance that it could cause a Dup issue.
I would set up a canonical tag to be safe.