update CHANGES

diff --git a/CHANGES b/CHANGES
index dd038c4fd8297e233959cd17ea59832989e06b35..61ca53953f4f9c1a5e9d819b6ef48e4748969a48 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -49,7 +49,10 @@
 4935.  [func]          Add support for LibreSSL >= 2.7.0 (some OpenSSL 1.1.0
                        call were added). [GL #191]
 
-4934.  [placeholder]
+4934.  [security]      Simultaneous use of stale cache records and NSEC
+                       aggressive negative caching could trigger a recursion
+                       loop. (CVE-2018-5737) [GL #185]
+
 
 4933.  [bug]           Not creating signing keys for an inline signed zone
                        prevented changes applied to the raw zone from being
@@ -121,10 +124,10 @@
                        like dig without IDN support.  libidn2 version 2.0
                        or higher is needed for +idnout enabled by default.
 
-4914.  [bug]           A bug in zone database reference counting could lead to
+4914.  [security]      A bug in zone database reference counting could lead to
                        a crash when multiple versions of a slave zone were
                        transferred from a master in close succession.
-                       [GL #134]
+                       (CVE-2018-5736) [GL #134]
 
 4913.  [test]          Re-implemented older unit tests in bin/tests as ATF,
                        removed the lib/tests unit testing library. [GL #115]