Add ChangeLog entry
diff --git a/ChangeLog b/ChangeLog
index 7c04ce0..b6067c6 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -3,6 +3,11 @@
= mbed TLS 2.1.x branch released xxxx-xx-xx
Security
+ * Fixed unlimited overread of heap-based buffer in mbedtls_ssl_read().
+ The issue could only happen client-side with renegotiation enabled.
+ Could result in DoS (application crash) or information leak
+ (if the application layer sent data read from mbedtls_ssl_read()
+ back to the server or to a third party). Can be triggered remotely.
* Add exponent blinding to RSA private operations as a countermeasure
against side-channel attacks like the cache attack described in
https://arxiv.org/abs/1702.08719v2.