1 files changed, 5 insertions, 0 deletions
diff --git a/CHANGELOG b/CHANGELOG
index 603b7dc65..f3b36bf00 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,5 +1,10 @@
 git-annex (6.20170521) UNRELEASED; urgency=medium
 
+  * Security fix: Disallow hostname starting with a dash, which
+    would get passed to ssh and be treated an option. This could
+    be used by an attacker who provides a crafted ssh url to execute
+    arbitrary code via -oProxyCommand.
+    (The same class of security hole recently affected git itself.)
   * Fix build with QuickCheck 2.10.
   * fsck: Support --json.
   * Added GIT_ANNEX_VECTOR_CLOCK environment variable, which can be used to