[docs] Add bug fix to release notes (elastic#2993) (elastic#2995)

changelogs/7.5.asciidoc

@@ -15,6 +15,14 @@ https://github.com/elastic/apm-server/compare/v7.4.1\...v7.5.0[View commits]
 - Introduce dedicated ILM setup flags and ignore `setup.template.*` flags for ILM {pull}2764[2764], {pull}2877[2877].
 - Remove ILM specific templates from `apm-server export template` command {pull}2764[2764].
 
+[float]
+==== Bug fixes
+- Fix a denial of service flaw when parsing malformed DSA public keys in Go.
+If APM Server is configured to accept incoming TLS connections with client
+authentication enabled, a remote attacker could cause the APM Server to stop
+processing events (CVE-2019-17596).
+See https://www.elastic.co/community/security/[Elastic security issues].
+
 [float]
 ==== Added
 - Add `service.node.configured_name` to Intake API and transform to `service.node.name` for ES output {pull}2746[2746].