diff --git a/ChangeLog b/ChangeLog
index 683a028..60dba27 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -46,6 +46,9 @@
    * Verify that when (f_send, f_recv and f_recv_timeout) send or receive
      more than the required length an error is returned. Raised by
      Sam O'Connor in #1245.
+   * Improve robustness of mbedtls_ssl_derive_keys against the use of
+     HMAC functions with non-HMAC ciphersuites. Independently contributed
+     by Jiayuan Chen in #1377. Fixes #1437.
 
 = mbed TLS 2.1.11 branch released 2018-03-16