Unhelpful update descriptions

[Przemek Klosowski]

On 03/12/2013 09:42 PM, Rahul Sundaram wrote:
> On 03/12/2013 08:17 PM, Jasper St. Pierre wrote:
>> What is the point of the RPM changelog then?
>
> RPM changelog is for packaging changes.  Bodhi update notes are for the
> user.  They are not merely redundant copies of the same information.

Aah, wait a minute. I was tickled pink when I discovered that I can look 
for vulnerability profile of a package by doing

rpm --changelog -q php | grep CVE

if RPM changelog is for packaging only this info wouldn't be there, 
right? If so, what would you recommend as a replacement?