For ubuntu 22.04 if this will create confusion, I feel like a good solution might be to improve error message and documentation to specifically suggest disabling ENABLE_IPC, or installing a newer version of capnproto. Ideally it seems like ubuntu could update from 0.8.0 to 0.8.1 given 0.8.1 was released to fix the CVE and doesn’t have any other changes.
On IPC being a trusted interface, it’s definitely true with the current interface, a malicious client could do a lot of things to crash the node and maybe even take control of it. But this doesn’t have to be the case. We could provide capnproto interfaces that do rigorously check all their inputs and enforce resource constraints. It would even be possible to adapt the Mining interface to do this, but it hasn’t been a reason to make the extra effort. I also feel like showing an error after discovering a package with a CVE is kind of a public service, since we don’t know if there may be other software using the package.