http: send payload when (proxy) authentication is done (#1918692)
curl: Inferior OCSP verification (CVE-2020-8286)
libcurl: FTP wildcard stack overflow (CVE-2020-8285)
curl: trusting FTP PASV responses (CVE-2020-8284)

validate an ssl connection using an intermediate certificate (#1895355)

fix multiarch conflicts in libcurl-minimal (#1895391)

do not crash when HTTPS_PROXY and NO_PROXY are used together (#1873327)
libcurl: wrong connect-only connection (CVE-2020-8231)

avoid overwriting a local file with -J (CVE-2020-8177)

load built-in openssl engines (#1854369)

double free due to subsequent call of realloc() (CVE-2019-5481)
fix heap buffer overflow in function tftp_receive_packet() (CVE-2019-5482)
fix TFTP receive buffer overflow (CVE-2019-5436)

rebuild with updated annobin to prevent Execshield RPMDiff check from failing

fix SMTP end-of-response out-of-bounds read (CVE-2019-3823)
fix NTLMv2 type-3 header stack buffer overflow (CVE-2019-3822)
fix NTLM type-2 out-of-bounds buffer read (CVE-2018-16890)
xattr: strip credentials from any URL that is stored (CVE-2018-20483)

do not let libssh create a new socket for SCP/SFTP (#1669156)

curl -J: do not append to the destination file (#1660827)

make the patch for CVE-2018-16842 apply properly (CVE-2018-16842)

SASL password overflow via integer overflow (CVE-2018-16839)
fix use-after-free in handle close (CVE-2018-16840)
fix bad arethmetic when outputting warnings to stderr (CVE-2018-16842)

enable TLS 1.3 post-handshake auth in OpenSSL (#1636900)

make the built-in manual compressed again (#1620217)

update the documentation of --tlsv1.0 in curl(1) man page (#1620217)