diff --git a/CHANGES b/CHANGES
index be4fe14..e9450f1 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,12 +1,6 @@
                                                      -*- coding: utf-8 -*-
 Changes with APR-util 2.0.0
 
-  *) LDAP detection improvements: --with-ldap now supports library names 
-     containing non-alphanumeric characters, such as libldap-2.4.so.  New
-     option --with-lber can be used to override the default liblber name.
-     Fix a problem reporting the lber library from apu-N-config.
-     [Jeff Trawick]
-
 Changes with APR-util 1.4.0
 
   *) Do not include apr.h and apr_errno.h from system search path in
@@ -36,9 +30,6 @@
   *) Provide a mechanism to provide the recommended crypto driver to
      calling application. [Graham Leggett]
 
-  *) Suppress pgsql column-out-of-range warning.
-     PR 46012 [Michiel van Loon <michiel van-loon.xs4all.nl>]
-
   *) Move APU_HAVE_CRYPTO from private apu_config.h to public apu.h.
      [Ruediger Pluem, Graham Leggett]
 
@@ -69,6 +60,18 @@
 
 Changes with APR-util 1.3.5
 
+  *) LDAP detection improvements: --with-ldap now supports library names
+     containing non-alphanumeric characters, such as libldap-2.4.so.  New
+     option --with-lber can be used to override the default liblber name.
+     Fix a problem reporting the lber library from apu-N-config.
+     [Jeff Trawick]
+
+  *) Suppress pgsql column-out-of-range warning.
+     PR 46012 [Michiel van Loon <michiel van-loon.xs4all.nl>]
+
+  *) Fix a buffer overrun and password matching for SHA passwords.
+     PR 45679 [Ben Noordhuis <bnoordhuis gmail.com>]
+
   *) Introduce DSO handling of the db, gdbm and ndbm drivers, so these are
      loaded as .so's on first demand, unless --disable-util-dso is configured.
      [William Rowe]
@@ -124,7 +127,7 @@
 Changes with APR-util 1.3.0
 
   *) apr_reslist: destroy all resources in apr_cleanup (don't give up on error).
-      PR 45086 [Nick Kew]
+     PR 45086 [Nick Kew]
 
   *) Add apr_brigade_split_ex for reusing existing brigades in situation where
      brigades need to be split often during the lifetime of a pool.
@@ -146,7 +149,7 @@
      drivers in particular. Using row number zero is an error.
      [Bojan Smojver]
 
-  *) Add support for OpenLDAP's ability to support a directory of 
+  *) Add support for OpenLDAP's ability to support a directory of
      certificate authorities. [Eric Covener]
 
   *) Better error detection for bucket allocation failures.