The fix for this issue was in the 1.3.7 release, but we didn't
refer to the CVE number explicitly in the release notes. Do
so now for the benefit of anyone auditing vulnerability
fixes in the future.

Signed-off-by: Mark Harris <mark.hsj@gmail.com>