Update release notes wrt #2999, cve id

Author: cowtowncoder

release-notes/VERSION-2.x

@@ -14,7 +14,7 @@ Project: jackson-databind
  (reported by Al1ex@knownsec)
 #2998: Block 2 more gadget types (org.apache.tomcat/tomcat-dbcp)
  (reported by Al1ex@knownsec)
-#2999: Block 1 more gadget type (org.glassfish.web/javax.servlet.jsp.jstl)
+#2999: Block 1 more gadget type (org.glassfish.web/javax.servlet.jsp.jstl, CVE-2020-35728)
  (reported by bu5yer of Sangfor FarSight Security Lab)
 
 2.9.10.7 (02-Dec-2020)