Changelog entry for PSA CBC-PKCS7 padding oracle fix
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
diff --git a/ChangeLog.d/pkcs7-padding-error-leak.txt b/ChangeLog.d/pkcs7-padding-error-leak.txt
new file mode 100644
index 0000000..5d204d5
--- /dev/null
+++ b/ChangeLog.d/pkcs7-padding-error-leak.txt
@@ -0,0 +1,5 @@
+Security
+ * Fix a timing side channel in CBC-PKCS7 decryption that could
+ allow an attacker who can submit chosen ciphertexts to recover
+ some plaintexts through a timing-based padding oracle attack.
+ Credits to Beat Heeb from Oberon microsystems AG. CVE-TODO