fix CHANGE notes

diff --git a/CHANGES b/CHANGES
index f1c4a20f8e8b0c9887645f5c13fbe8e1bbbda8c5..558698f8f035ec079eea77a0e46ecc771e86b9e9 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+4904.   [bug]           Temporarily revert change #4859. [GL #124]
+
 4903.  [bug]           "check-mx fail;" did not prevent MX records containing
                        IP addresses from being added to a zone by a dynamic
                        update. [GL #112]
@@ -145,7 +147,11 @@
 
 4860.  [bug]           isc_int8_t should be signed char.  [RT #46973]
 
-4859.   [placeholder]
+4859.   [bug]           A loop was possible when attempting to validate
+                        unsigned CNAME responses from secure zones;
+                        this caused a delay in returning SERVFAIL and
+                        also increased the chances of encountering
+                        CVE-2017-3145. [RT #46839]
 
 4858.  [security]      Addresses could be referenced after being freed
                        in resolver.c, causing an assertion failure.