diff --git a/apache-commons-compress.spec b/apache-commons-compress.spec
index 8d975ec..937f5cc 100644
--- a/apache-commons-compress.spec
+++ b/apache-commons-compress.spec
@@ -2,8 +2,8 @@
 %global short_name      commons-%{base_name}
 
 Name:           apache-%{short_name}
-Version:        1.17
-Release:        2%{?dist}
+Version:        1.18
+Release:        1%{?dist}
 Summary:        Java API for working with compressed files and archivers
 License:        ASL 2.0
 URL:            http://commons.apache.org/proper/commons-compress/
@@ -73,6 +73,10 @@ rm src/test/java/org/apache/commons/compress/OsgiITest.java
 %doc LICENSE.txt NOTICE.txt
 
 %changelog
+* Fri Oct 05 2018 Marian Koncek <mkoncek@redhat.com> - 1.18-1
+- Update to upstream version 1.18
+- Resolves: CVE-2018-11771
+
 * Thu Jul 12 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.17-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
 
diff --git a/sources b/sources
index 66cff15..dac24ab 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (commons-compress-1.17-src.tar.gz) = eef0eb15b70c8aa1c1ccd67d4b50d5a94b3acf8f94b707a60abd41f3994319bd7b90402307f4be1bbfe12b34fed62aa4b8eb95e3457b9f2a7a682333f9e71e5e
+SHA512 (commons-compress-1.18-src.tar.gz) = e601e150e58ee453991789e0e58337e71725210fc798d77954ce525ba6fd3312a3b0174aba9f4bfbe7c6bac806a29247ad6a31eca8bd540c6f850777bf8a926d