GitLab

See: #12950

CVE-2021-36159

J0WI authored Jun 14, 2021 and Natanael Copa committed Jun 14, 2021

(cherry picked from commit a1d28041)

Alpine's curl package isn't vulnerable to CVE-2021-22897 - add it to the
secfixes list to reduce false positives from security scanners.

Cherry-pick the fix for CVE-2021-22898 from upstream:
https://github.com/curl/curl/commit/39ce47f219b09c380b81f89fe54ac586c8db6bde

J0WI authored May 26, 2021 and Jakub Jirutka committed May 26, 2021

See http://mailman.nginx.org/pipermail/nginx-announce/2021/000300.html

This is now handled by the build script itself so that it's able to skip
this step in case the size is larger than the limit.

See #12668

- CVE-2020-15078

Jake Buchholz Göktürk authored Jan 09, 2021 and Mike Crute committed May 01, 2021

explicitly locks the root account

No patches are available for 1.8.27

See #12356