[gnome-autoar] NEWS: Add CVE number

[Ondrej Holy <oholy src gnome org>]

commit 8208609dd0569ec975aaff01d3dc46a2b2a675c9
Author: Ondrej Holy <oholy redhat com>
Date:   Wed Mar 24 10:29:19 2021 +0100

    NEWS: Add CVE number
    
    The CVE number for GNOME/gnome-autoar#12 has been assigned after the
    release, so it is not part of the NEWS file. Let's add the CVE number
    additionaly at least.

 NEWS | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
---
diff --git a/NEWS b/NEWS
index 1f1488d..45f7ccb 100644
--- a/NEWS
+++ b/NEWS
@@ -1,5 +1,5 @@
 Major changes in 0.3.1:
-* Disallow symlinks in parents completely when extracting (Ondrej Holy)
+* CVE-2021-28650: Disallow symlinks in parents completely when extracting (Ondrej Holy)
 * Make AutoarExtractor documentation clearer (Ondrej Holy)
 * Drop recursive delete on failure to prevent data loss (Ondrej Holy)
 * Add back RAR support (Matthias)