{"cve":"CVE-2020-10737","nvd":{"published":"2020-05-27T01:15:09.230","modified":"2026-06-17T02:48:21.173","status":"Modified","description":"A race condition was found in the mkhomedir tool shipped with the oddjob package in versions before 0.34.5 and 0.34.6 wherein, during the home creation, mkhomedir copies the /etc/skel directory into the newly created home and changes its ownership to the home's user without properly checking the homedir path. This flaw allows an attacker to leverage this issue by creating a symlink point to a target folder, which then has its ownership transferred to the new home directory's unprivileged user.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","score":6.3},"cwes":["CWE-362"],"references":["https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10737","https://pagure.io/oddjob/c/10b8aaa1564b723a005b53acc069df71313f4cac?branch","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10737","https://pagure.io/oddjob/c/10b8aaa1564b723a005b53acc069df71313f4cac?branch"],"products":["redhat:oddjob"],"source":"nvd","synced_at":"2026-10-19T21:05:42.039641217+00:00"},"epss":{"cve":"CVE-2020-10737","score":0.00293,"percentile":0.21934,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}