2 files changed, 13 insertions, 1 deletions
diff --git a/ChangeLog b/ChangeLog
index c4c3076bcc..1a5cfc794e 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,15 @@
+Sat Sep  9 22:50:10 2017  NARUSE, Yui  <naruse@ruby-lang.org>
+
+	A HTTP Header value must not contain CR or LF.
+	to_str -> to_s
+
+	* lib/net/http/header.rb (set_field): `val` can not have `to_str`.
+
+Sat Sep  9 22:42:22 2017  Kouhei Sutou  <kou@cozmixng.org>
+
+	* REXML: Fix a bug that unexpected methods can be called as a XPath
+	  function. [HackerOne:249295] Reported by Andrea Jegher. Thanks!!!
+
 Sat Sep  9 22:16:01 2017  SHIBATA Hiroshi  <hsbt@ruby-lang.org>
 
 	* lib/rubygems: fix several vulnerabilities in RubyGems; bump to version
diff --git a/version.h b/version.h
index c47039b75a..857b7d7d5b 100644
--- a/version.h
+++ b/version.h
@@ -1,6 +1,6 @@
 #define RUBY_VERSION "2.3.5"
 #define RUBY_RELEASE_DATE "2017-09-09"
-#define RUBY_PATCHLEVEL 366
+#define RUBY_PATCHLEVEL 367
 
 #define RUBY_RELEASE_YEAR 2017
 #define RUBY_RELEASE_MONTH 9