Skip to content
Fencer Vulns
medium 6.3

CVE-2020-10737 json

A race condition was found in the mkhomedir tool shipped with the oddjob package in versions before 0.34.5 and 0.34.6 wherein, during the h…

published 2020-05-27 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-3161

cvss
6.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 22%
public exploits
0
none known

Summary

A race condition was found in the mkhomedir tool shipped with the oddjob package in versions before 0.34.5 and 0.34.6 wherein, during the home creation, mkhomedir copies the /etc/skel directory into the newly created home and changes its ownership to the home's user without properly checking the homedir path. This flaw allows an attacker to leverage this issue by creating a symlink point to a target folder, which then has its ownership transferred to the new home directory's unprivileged user.

Patch / fix

  • redhat oddjob 0.34.5
  • oddjob Debian 14, Debian 13, Debian 12 0.34.6-1

debian advisories DEBIAN-CVE-2020-10737

  • oddjob Ubuntu Pro 16.04 LTS 0.34.3-2ubuntu0.1~esm1
  • oddjob Ubuntu Pro 18.04 LTS 0.34.3-4ubuntu0.1~esm1
  • oddjob Ubuntu Pro 20.04 LTS 0.34.4-1ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2020-10737

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • oddjob RHEL 8 0.34.5-3.el8
  • oddjob-mkhomedir RHEL 8 0.34.5-3.el8

red hat advisories RHSA-2020:4687

  • oddjob openSUSE Tumbleweed 0.34.5-1.9

opensuse advisories openSUSE-SU-2024:11109-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-10737 updated cvss 6.3

oddjob: race condition in oddjob_selinux_mkdir function in mkhomedir.c can lead to symlink attack

  • Red Hat Enterprise Linux 6 oddjob, oddjob-mkhomedir
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 7 oddjob, oddjob-mkhomedir
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux AppStream (v. 8) oddjob 0.34.5-3.el8, oddjob-mkhomedir 0.34.5-3.el8
    fixed: vendor fix RHSA-2020:4687

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.29% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
NVD 3.1 6.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
NVD 2.0 3.7 AV:L/AC:H/Au:N/C:P/I:P/A:P

Affected products

  • Red Hat oddjob

Classification

Weakness
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.