GitLab

CVE-2021-36159

(cherry picked from commit a1d28041)

Alpine's curl package isn't vulnerable to CVE-2021-22897 - add it to the
secfixes list to reduce false positives from security scanners.

Cherry-pick the fix for CVE-2021-22898 from upstream:
https://github.com/curl/curl/commit/39ce47f219b09c380b81f89fe54ac586c8db6bde

See http://mailman.nginx.org/pipermail/nginx-announce/2021/000300.html

This is now handled by the build script itself so that it's able to skip
this step in case the size is larger than the limit.

See #12668

- CVE-2020-15078

explicitly locks the root account

No patches are available for 1.8.27

See #12356