diff --git a/.gitignore b/.gitignore
index b8e8a9a..91d64fa 100644
--- a/.gitignore
+++ b/.gitignore
@@ -18,3 +18,4 @@ koji-1.4.0.tar.bz2
 /koji-1.16.2.tar.bz2
 /koji-1.17.0.tar.bz2
 /koji-1.18.0.tar.bz2
+/koji-1.18.1.tar.bz2
diff --git a/koji.spec b/koji.spec
index eadd0c1..8bf5a47 100644
--- a/koji.spec
+++ b/koji.spec
@@ -78,8 +78,8 @@
 %endif
 
 Name: koji
-Version: 1.18.0
-Release: 6%{?dist}
+Version: 1.18.1
+Release: 1%{?dist}
 # the included arch lib from yum's rpmUtils is GPLv2+
 License: LGPLv2 and GPLv2+
 Summary: Build system tools
@@ -700,6 +700,9 @@ fi
 %endif
 
 %changelog
+* Wed Oct 09 2019 Patrick Uiterwijk <patrick@puiterwijk.org> - 1.18.1-1
+- Rebase to 1.18.1 for CVE-2019-17109
+
 * Wed Sep 18 2019 Jiri Popelka <jpopelka@redhat.com> - 1.18.0-6
 - Fix macro added in previous change.
 
diff --git a/sources b/sources
index 9c7e1c4..7b21f84 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (koji-1.18.0.tar.bz2) = 6229ddde6b0d792d3a8d71ab5cdf7cbed525d64c58b41e779ceac56ae0608ca2eac1346e86ba2e0ce5d64126cc57a50e6ab89253b2c1862ed6f5ca02e1591f6d
+SHA512 (koji-1.18.1.tar.bz2) = db8743cbd10434ec460b97af3e747495f46b3a1e4704957fb1c53a4c15ddbde31845e8eee1b97fcb7e5c030c6c7df510b5d8af960c62d4a0ad7752d6658ee0de