Changelog entries that refer to specific bug numbers or CAN numbers can be quite helpful in this regard.
What would be incredibly useful is to move (to being a Provides) the CVE names for issues that we're including a backported fix for. Where we've moved to an upstream version that contains fixes those CVE names are less important as they can be deduced by a simple NV check.
Just before each FC release the security team here go through a few years of security issues normalized to CVE names and make a list of how each FC package fixed it ("not vulnerable due to upstream version" or "contains backported fix"). It helps catch any missing fixes too ;)
(This is something I'm thinking we'll try to do after our FC4 audit).
Cheers, Mark
