> the fix is simply to install security patch updates as per standard best practice.

Absolutely. On systems where the administrator can either

• install only security patches, or
• install all package updates, without compromising the purpose of the system,

this is the recommended action.

That is an impressive tabulation of systems! However you included fixes for only three.  And for at least several of those that I spot-check the fix is simply to install security patch updates as per standard best practice.  I imagine that most of those would be fixed simply by installing the latest official security patches for each system.  For one example I am routinely using Debian 9 and Debian 10 systems and cannot reproduce the problem on maintained systems.

And then for example I just now as a test installed an ISO of ubuntu-16.04.4-desktop-i386.iso from 2018 which I had available and by 2018 it had already been patched for this issue.  And having been patched I could not reproduce the problem.

Being curious I then downloaded and installed a pristine Ubuntu 16.04-server (no point releases, the original release) from 2016 and did reproduce the problem at that vintage.  Without exhaustively going through the releases this says that the issue was fixed before 2018.

I am as much of a fan of having a large matrix of systems and versions as anyone.  But any system that interacts with the hostile Internet will find that the hostile Internet is always changing.  Whether we like it or not we find it impossible to freeze those parts that communicate and interact.  Not because the local end has changed but because the remote end of the communicating pair has changed.  Sometimes whether we like it or not we simply must upgrade the local part of our client in order to communicate.

As to the other two pages you asked to have hints placed for documentation for the /tls page I obsoleted it entirely since it was truly so old it was harmfully misinformed.  I redirected that page to the other one.  The other one was originally just a few lines.  I expanded it with a first pass description of everything I know about things now and various hints.

https://savannah.gnu.org/maintenance/SavannahTLSInfo/

> I am surprised that you found Ubuntu 16.04 and Ubuntu 18.04 affected since as I understood it those were still under LTS support and I presume would have updates available to them.

I tested Ubuntu 16.04 and Ubuntu 18.04 in their original state, not fully patched.
1) because the Docker images for these OSes, used for continuous integration builds, are not fully patched.
2) because also some desktop users prefer to not fully patch their systems.

The simple commands mentioned in https://stackoverflow.com/questions/21181231/

sudo apt-get install -y apt-transport-https ca-certificates
sudo update-ca-certificates

work on Ubuntu 18.04; they upgrade the package 'ca-certificates' to version 20210119~18.04.2, and this fixes the issue.

However, on Ubuntu 16.04 in its original state they don't help.

As you have deduced this is a client side problem.  It is one that has perhaps caught a large number of people operating older client systems unawares however.  I'll post something to the web UI front page.  And then go look at the pages you referenced and add hints there too.

I am surprised that you found Ubuntu 16.04 and Ubuntu 18.04 affected since as I understood it those were still under LTS support and I presume would have updates available to them.  Debian has posted patches for their LTS suites.  I looked at Debian 9 "Stretch", which is now N-2 releases old, and found it has been LTS patched.

References to Debian patches.
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=961889
https://lists.debian.org/debian-lts/2021/09/msg00008.html

Regarding client-side fixes:

https://stackoverflow.com/questions/21181231/ gives a number of workarounds, but some of them have negative security implications. For example,

$ GIT_SSL_NO_VERIFY=1 git clone https://git.savannah.gnu.org/git/gnulib.git

works, but disable SSL/TLS checking and thus opens the door to DNS spoofing and man-in-the-middle attacks.

It depends on the operating system.

Affected: Ubuntu 16.04 and 18.04.

Not affected: Ubuntu 20.04