release-notes/5.20.0

release-notes.md

@@ -20,6 +20,7 @@ Other resources for identifying changes are:
 Released December 4, 2019
 
 - **[Synopsis](release-notes/5.20.0.md#synopsis)**
+- **[Security advisories](release-notes/5.20.0.md#security)**
 - **[Features](release-notes/5.20.0.md#features)**
 - **[Bugs resolved](release-notes/5.20.0.md#bugs)**
 - **[Miscellany](release-notes/5.20.0.md#misc)**

release-notes/5.20.0.md

@@ -21,6 +21,10 @@ Released December 4, 2019
 | **Introduce features?**                                         | **yes** |
 | **Fix bugs?**                                                   | **yes** |
 
+## <a name="security"></a>Security advisories
+
+- **[CIVI-SA-2019-24](https://civicrm.org/advisory/civi-sa-2019-24-csrf-in-apiv4-ajax-end-point): Cross-site request forgery in APIv4 AJAX endpoint**
+
 ## <a name="features"></a>Features
 
 ### Core CiviCRM