Update CHANGES.txt for commit of HADOOP 12413 to 2.7.3 and 2.6.3

hadoop-common-project/hadoop-common/CHANGES.txt

@@ -895,9 +895,6 @@ Release 2.8.0 - UNRELEASED
     HADOOP-12324. Better exception reporting in SaslPlainServer.
     (Mike Yoder via stevel)
 
-    HADOOP-12413. AccessControlList should avoid calling getGroupNames in
-    isUserInList with empty groups. (Zhihai Xu via cnauroth)
-
     HADOOP-12404. Disable caching for JarURLConnection to avoid sharing
     JarFile with other users when loading resource from URL in Configuration
     class. (zxu)
@@ -1422,6 +1419,9 @@ Release 2.7.3 - UNRELEASED
 
   IMPROVEMENTS
 
+    HADOOP-12413. AccessControlList should avoid calling getGroupNames in
+    isUserInList with empty groups. (Zhihai Xu via cnauroth)
+
   OPTIMIZATIONS
 
   BUG FIXES
@@ -2210,6 +2210,9 @@ Release 2.6.3 - UNRELEASED
 
   IMPROVEMENTS
 
+    HADOOP-12413. AccessControlList should avoid calling getGroupNames in
+    isUserInList with empty groups. (Zhihai Xu via cnauroth)
+
   OPTIMIZATIONS
 
   BUG FIXES