A recent audit was performed on libcap and friends by https://x41-dsec.de/ . (The audit was sponsored by the the Open Source Technology Improvement Fund (https://ostif.org/). The audit detected 5 issues labeled as follows: LCAP-CR-23-01 - (SEVERITY) LOW LCAP-CR-23-02 - (SEVERITY) MEDIUM LCAP-CR-23-100 - (SEVERITY) NONE LCAP-CR-23-101 - (SEVERITY) NONE LCAP-CR-23-102 - (SEVERITY) NONE I plan to release fixes for all of these with libcap-2.69.
On closer inspection, I will not be addressing LCAP-CR-23-102 in the libcap-2.69 release. As noted, is has no severity, and so I feel it can benefit from further thought and investigation.
My plan is to push the fixes and cut a libcap-2.69 release on 2023-05-15.
These two issues have been assigned CVE ids: LCAP-CR-23-01 - (SEVERITY) LOW -> CVE-2023-2602 LCAP-CR-23-02 - (SEVERITY) MEDIUM -> CVE-2023-2603
The LCAP-CR-23-102 issue is the subject of https://bugzilla.kernel.org/show_bug.cgi?id=217476 libcap-2.69 was released a week ago.