diff --git a/ChangeLog b/ChangeLog
index 9b3dc5c..3de3184 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -9,6 +9,10 @@
    * Fix buffer overflow in RSA-PSS verification when the unmasked
      data is all zeros.
 
+Bugfix
+   * Fix some invalid RSA-PSS signatures with keys of size 8N+1 that were
+     accepted. Generating these signatures required the private key.
+
 = mbed TLS 1.3.21 branch released 2017-08-10
 
 Security