diff --git a/.gitignore b/.gitignore
index 6eb3b69..78c395b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -130,3 +130,5 @@
 /freeipa-4.11.0beta1.tar.gz.asc
 /freeipa-4.11.0.tar.gz
 /freeipa-4.11.0.tar.gz.asc
+/freeipa-4.11.1.tar.gz
+/freeipa-4.11.1.tar.gz.asc
diff --git a/freeipa.spec b/freeipa.spec
index b8aee8e..62ad65e 100644
--- a/freeipa.spec
+++ b/freeipa.spec
@@ -188,7 +188,7 @@
 
 # Work-around fact that RPM SPEC parser does not accept
 # "Version: @VERSION@" in freeipa.spec.in used for Autoconf string replacement
-%define IPA_VERSION 4.11.0
+%define IPA_VERSION 4.11.1
 # Release candidate version -- uncomment with one percent for RC versions
 #%%global rc_version
 %define AT_SIGN @
@@ -201,7 +201,7 @@
 
 Name:           %{package_name}
 Version:        %{IPA_VERSION}
-Release:        7%{?rc_version:.%rc_version}%{?dist}
+Release:        1%{?rc_version:.%rc_version}%{?dist}
 Summary:        The Identity, Policy and Audit system
 
 License:        GPL-3.0-or-later
@@ -1744,6 +1744,10 @@ fi
 %endif
 
 %changelog
+* Wed Jan 10 2024 Alexander Bokovoy <abokovoy@redhat.com> - 4.11.1-1
+- Security release: CVE-2023-5455
+- Resolves: rhbz#2257646
+
 * Wed Nov 08 2023 Alexander Bokovoy <abokovoy@redhat.com> - 4.11.0-7
 - ipalib: fix the IPACertificate validity dates (python 3.12 compatibility)
 - Handle PKI revocation response differences in JSON API
diff --git a/sources b/sources
index b86cbff..9071b2d 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (freeipa-4.11.0.tar.gz) = 2af27248bfa1cb39f52eb38d0ffcf76d8eed5397aca89932f6a6cef622fb93875c1b17b79742c6b67a086a84b02dacbc8ea05b3bc481cd296fe983f4ae13a80f
-SHA512 (freeipa-4.11.0.tar.gz.asc) = 6464605296e00281cf0e22ff7e479f4100762a2aa2e2ae78a1c9e8f83ff5a7cdf13da610f5a1da4711552aa3268de04cb442bde37ecb5f716937a5f902b66825
+SHA512 (freeipa-4.11.1.tar.gz) = 65c3ccc8a6da71b2bad3efdf9e798b0d65e6d1e2c3a6ed6617ab86d7e8a5fa01ba2787714a3004b01e35fe087f464e0ae22d0fe4b254956262e7d96d61b1e84d
+SHA512 (freeipa-4.11.1.tar.gz.asc) = 31157e852653681d3914aebc4b98babf16c4131f647ed6b4c2b49d07f50ac393f54fb1a9d9fcbcf6772eccf5bae7331912ad3e3508bf8cac7d7e74c676bdbc60