Add CHANGES note for [GL #2950]

diff --git a/CHANGES b/CHANGES
index 0224b17784c0defcedebde2e403c31c80e4bed36..d05a7c67d04596499c42c4c0691e90d92be2c272 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -41,7 +41,10 @@
 
 5818.  [placeholder]
 
-5817.  [placeholder]
+5817.  [security]      The rules for acceptance of records into the cache
+                       have been tightened to prevent the possibility of
+                       poisoning if forwarders send records outside
+                       the configured bailiwick. (CVE-2021-25220) [GL #2950]
 
 5816.  [bug]           Make BIND compile with LibreSSL 3.5.0, as it was using
                        not very accurate pre-processor checks for using shims.