diff --git a/.gitignore b/.gitignore
index 5859f2d..4eb6e49 100644
--- a/.gitignore
+++ b/.gitignore
@@ -23,3 +23,4 @@
 /dulwich-0.15.0.tar.gz
 /dulwich-0.16.0.tar.gz
 /dulwich-0.18.4.tar.gz
+/dulwich-0.18.6.tar.gz
diff --git a/python-dulwich.spec b/python-dulwich.spec
index 8e40774..aa361bd 100644
--- a/python-dulwich.spec
+++ b/python-dulwich.spec
@@ -5,7 +5,7 @@
 %global __provides_exclude_from ^(%{python3_sitearch}/.*\\.so)$
 
 Name:           python-%{srcname}
-Version:        0.18.4
+Version:        0.18.6
 Release:        1%{?dist}
 Summary:        %{sum}
 
@@ -99,6 +99,10 @@ rm -rf %{buildroot}%{python3_sitearch}/docs/tutorial/
 %exclude %{python3_sitearch}/%{srcname}/tests*
 
 %changelog
+* Mon Nov 27 2017 Alan Pevec <alan.pevec@redhat.com> 0.18.6-1
+- Update to 0.18.6
+- Fixes CVE-2017-16228
+
 * Fri Oct 13 2017 Fabian Affolter <mail@fabian-affolter.ch> - 0.18.4-1
 - Update to new upstream version 0.16.0 (rhbz#*1405983)
 
diff --git a/sources b/sources
index c475ff2..f85f2b9 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (dulwich-0.18.4.tar.gz) = 56128864f66a585e1aa8b543c2453311f176d8626b38a8b5891b2ed31b544904245755c9de9e7f757898863f2c2caf4dd0249abde2594a0e25c3826bb2188a77
+SHA512 (dulwich-0.18.6.tar.gz) = 2d2120e23dd4bc2c9dcfe601f21ac757ee3fe2a343923c50b32c067f4d329ac89cdf0894bff450bf52c69e99759bb8692f0f14ed73d01be6bc3b0402d58d1148