diff --git a/.gitignore b/.gitignore
index 0696950..da7e9f7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -237,3 +237,5 @@ samba-3.6.0pre1.tar.gz
 /samba-4.13.6.tar.asc
 /samba-4.13.7.tar.xz
 /samba-4.13.7.tar.asc
+/samba-4.13.8.tar.xz
+/samba-4.13.8.tar.asc
diff --git a/samba.spec b/samba.spec
index 69a67a1..427f130 100644
--- a/samba.spec
+++ b/samba.spec
@@ -8,9 +8,9 @@
 
 %define samba_requires_eq()  %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not")
 
-%define main_release 1
+%define main_release 0
 
-%define samba_version 4.13.7
+%define samba_version 4.13.8
 %define talloc_version 2.3.1
 %define tdb_version 1.4.3
 %define tevent_version 0.10.2
@@ -3628,6 +3628,10 @@ fi
 %endif
 
 %changelog
+* Thu Apr 29 2021 Guenther Deschner <gdeschner@redhat.com> - 4.13.8-0
+- Update to Samba 4.13.8
+- resolves: #1949442, #1955027 - Security fixes for CVE-2021-20254
+
 * Wed Apr 07 2021 Alexander Bokovoy <abokovoy@redhat.com> - 4.13.7-1
 - Fix memory leaks in RPC server
 - resolves: #1946950
diff --git a/sources b/sources
index e69c225..ef6fe0d 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (samba-4.13.7.tar.xz) = 2e22370523c7ecee94b374f0950c91217fcbc5e087433ca7375eb6341b7132611c675b869bfa6d9c726d77a279f7a6c2bbeb30dcdd84dc77841b295eafe15557
-SHA512 (samba-4.13.7.tar.asc) = 1af3cdfde624ed93f44c368981b4d45ec6a78645a920e952e2b0965c78a1e515322cfd23199c93c38f50ebb85cfe0f6998ff59e50ac20e0f526276f762f917ed
+SHA512 (samba-4.13.8.tar.xz) = 777cb3ff452288fb086daa4772bb88a4c97144330fec46738f00c0e74263be0d00f75106c666ec42158f986e77f81a0e7ec04c1088753ec2847474984a89ee7e
+SHA512 (samba-4.13.8.tar.asc) = 105530a11014bac9f4466a1413fee0060078264c08426a65aab86f52947a8d8d3557dbf6216cae6808cc3deab1a37378f1da3f17cae956a24adf69c7908908b7