diff --git a/ChangeLog.d/pkcs7-reject-weak-hashes.txt b/ChangeLog.d/pkcs7-reject-weak-hashes.txt
new file mode 100644
index 0000000000..61cc03affe
--- /dev/null
+++ b/ChangeLog.d/pkcs7-reject-weak-hashes.txt
@@ -0,0 +1,3 @@
+Security
+   * PKCS7 now rejects weak hash algorithms (RIPEMD160, MD5, SHA-1) on signature
+     verification.