diff --git a/.gitignore b/.gitignore
index d7fca8b..89b6a70 100644
--- a/.gitignore
+++ b/.gitignore
@@ -672,3 +672,4 @@
 /buildah-5181b9c.tar.gz
 /buildah-802a904.tar.gz
 /buildah-6d5d1ae.tar.gz
+/buildah-ec35bc4.tar.gz
diff --git a/buildah.spec b/buildah.spec
index 29e41c2..66266e9 100644
--- a/buildah.spec
+++ b/buildah.spec
@@ -24,12 +24,10 @@
 # https://github.com/containers/buildah
 %global import_path %{provider}.%{provider_tld}/%{project}/%{repo}
 %global git0 https://%{import_path}
-%global commit0 6d5d1aed0db9f91a1f4681dffd63214af5a2136f
+%global commit0 ec35bc428a4b19a4a6892845644aa48aa577739e
 %global shortcommit0 %(c=%{commit0}; echo ${c:0:7})
 
-# Used for comparing with latest upstream tag
-# to decide whether to autobuild (non-rawhide only)
-%define built_tag v1.21.1
+%define built_tag v1.21.3
 %define built_tag_strip %(b=%{built_tag}; echo ${b:1})
 %define download_url https://%{import_path}/archive/%{built_tag}.tar.gz
 
@@ -157,6 +155,9 @@ cp bin/imgtype %{buildroot}/%{_bindir}/%{name}-imgtype
 %{_datadir}/%{name}/test
 
 %changelog
+* Fri Jul 16 2021 Lokesh Mandvekar <lsm5@fedoraproject.org> - 1.22.0-0.12.dev.gitec35bc4
+- Resolves: #1982880 - Security fix for CVE-2021-3602
+
 * Wed Jun 23 2021 RH Container Bot <rhcontainerbot@fedoraproject.org> - 1.22.0-0.11.dev.git6d5d1ae
 - autobuilt 6d5d1ae
 
diff --git a/sources b/sources
index bbda3f7..98402c0 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (buildah-6d5d1ae.tar.gz) = 8b4636fd9b860da97e36c188ed2372fe3df85102cf2b076484e385370a83a9a4ed0cee45070928f710927c05ecdd9c7d688df4dce46fe242c86023f960c7609c
+SHA512 (buildah-ec35bc4.tar.gz) = aff2c9b3a6dce1691d211e92aca0a59adeb52331a18e7b26230513f4e929ae299810af013a40c1e85d7060de264bedbc5a6c56d9337433189b14d49648d08a2a