diff --git a/.gitignore b/.gitignore
index f78d372..f797522 100644
--- a/.gitignore
+++ b/.gitignore
@@ -29,3 +29,4 @@
 /libreswan-3.26.tar.gz
 /libreswan-3.27.tar.gz
 /libreswan-3.28.tar.gz
+/libreswan-3.29.tar.gz
diff --git a/libreswan.spec b/libreswan.spec
index a14c293..deae595 100644
--- a/libreswan.spec
+++ b/libreswan.spec
@@ -28,7 +28,7 @@
 Name: libreswan
 Summary: IPsec implementation with IKEv1 and IKEv2 keying protocols
 # version is generated in the release script
-Version: 3.28
+Version: 3.29
 Release: %{?prever:0.}1%{?prever:.%{prever}}%{?dist}
 License: GPLv2
 Url: https://libreswan.org/
@@ -208,8 +208,11 @@ export NSS_DISABLE_HW_GCM=1
 %{_libdir}/fipscheck/pluto.hmac
 
 %changelog
+* Mon Jun 10 2019 Paul Wouters <pwouters@redhat.com> - 3.29-1
+- Updated to 3.29 for CVE-2019-10155
+
 * Tue May 21 2019 Paul Wouters <pwouters@redhat.com> - 3.28-1
-- Updated to 3.28 (many imported bugfixes)
+- Updated to 3.28 (many imported bugfixes, including CVE-2019-12312)
 
 * Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 3.27-1.2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
diff --git a/sources b/sources
index eb59415..971f925 100644
--- a/sources
+++ b/sources
@@ -1,4 +1,4 @@
 SHA512 (ikev1_dsa.fax.bz2) = 627cbac14248bd68e8d22fbca247668a7749ef0c2e41df8d776d62df9a21403d3a246c0bd82c3faedce62de90b9f91a87f753e17b056319000bba7d2038461ac
 SHA512 (ikev1_psk.fax.bz2) = 1b2daec32edc56b410c036db2688c92548a9bd9914994bc7e555b301dd6db4497a6b3e89dc12ddf36826ae90b40fcde501a5a45c0d59098e07839073d219d467
 SHA512 (ikev2.fax.bz2) = 0d3748d1bd574f6f1f3e4db847eca126ce649566ea710ef227426f433122752b80d1d6b8acf9d0df07b5597c1e45447e3a2fcb3391756e834e8e75f99df8e51e
-SHA512 (libreswan-3.28.tar.gz) = aeb3ea723f2ca10098f2626172166cddea59b3bc084f0fefc823fd784d8986b12adc5a5b0965f2c7ecdfff5ac8029a922b8357debf79ff43605783d80e144983
+SHA512 (libreswan-3.29.tar.gz) = 4b4d91204d8b1724e0a9ad3ed55fc232c9a526211c3b47b6cc33fd160feb72538ef1661becca250bde815b9d7b75709bf16c7b372476605557b47c785cdf2535