diff --git a/.gitignore b/.gitignore
index 028dd9e..a806280 100644
--- a/.gitignore
+++ b/.gitignore
@@ -82,3 +82,5 @@
 /freeipa-4.8.2.tar.gz.asc
 /freeipa-4.8.3.tar.gz
 /freeipa-4.8.3.tar.gz.asc
+/freeipa-4.8.4.tar.gz
+/freeipa-4.8.4.tar.gz.asc
diff --git a/freeipa.spec b/freeipa.spec
index 9abc088..51d8499 100644
--- a/freeipa.spec
+++ b/freeipa.spec
@@ -133,7 +133,7 @@
 
 # Work-around fact that RPM SPEC parser does not accept
 # "Version: @VERSION@" in freeipa.spec.in used for Autoconf string replacement
-%define IPA_VERSION 4.8.3
+%define IPA_VERSION 4.8.4
 %define AT_SIGN @
 # redefine IPA_VERSION only if its value matches the Autoconf placeholder
 %if "%{IPA_VERSION}" == "%{AT_SIGN}VERSION%{AT_SIGN}"
@@ -1355,6 +1355,9 @@ fi
 
 
 %changelog
+* Sat Dec 14 2019 Alexander Bokovoy <abokovoy@redhat.com> - 4.8.4-1
+- New upstream release 4.8.4
+
 * Tue Nov 26 2019 Alexander Bokovoy <abokovoy@redhat.com> - 4.8.3-1
 - New upstream release 4.8.3
 - CVE-2019-14867: Denial of service in IPA server due to wrong use of ber_scanf()
diff --git a/sources b/sources
index 5ee2a36..432367d 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (freeipa-4.8.3.tar.gz) = b6bc7410397a6c85f66308aaa8fc223297b50d03ddfaa0b8093b0a240cf9418423eb94255e63f227365157158d2e1a768ba93eec1f4fe7e0d108fa27b4121c5f
-SHA512 (freeipa-4.8.3.tar.gz.asc) = 25c0a142389ee5ea8b21029ce7e33781d301a1a021f0cec405eca111bdcb68d5508fb605b4977552bdcd7e44edc24336557c667f217f086abbe50608e4cd2b03
+SHA512 (freeipa-4.8.4.tar.gz) = 55ff0386a5ee0400dd382eee6ca6d99eaeee1b3e2d47e8aab46d888a9df561871d2ce706ae9cf687f6e07245cb6392150eafddc9695f4dca4b578c5af5e752d5
+SHA512 (freeipa-4.8.4.tar.gz.asc) = f94ff867871e97f23be4cd02cd1a3343ee86b9f8aa43e46c6dac8ae4d88fcbac2b66a110d8d292c319c76c4a43db266b9e0c0ba59f82a117b14629c52d421249