diff --git a/.gitignore b/.gitignore
index 551f36d..f04ed2d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -193,3 +193,4 @@ setroubleshoot-2.2.93.tar.gz
 /setroubleshoot-3.3.7.tar.gz
 /setroubleshoot-3.3.8.tar.gz
 /setroubleshoot-3.3.8.1.tar.gz
+/setroubleshoot-3.3.9.1.tar.gz
diff --git a/setroubleshoot.spec b/setroubleshoot.spec
index b9e6925..f8a5b7d 100644
--- a/setroubleshoot.spec
+++ b/setroubleshoot.spec
@@ -1,6 +1,6 @@
 Summary: Helps troubleshoot SELinux problems
 Name: setroubleshoot
-Version: 3.3.8.1
+Version: 3.3.9.1
 Release: 1%{?dist}
 License: GPLv2+
 Group: Applications/System
@@ -201,6 +201,10 @@ rm -rf %{buildroot}
 
 
 %changelog
+* Tue Jun 21 2016 Petr Lautrbach <plautrba@redhat.com> - 3.3.9.1-1
+- Do not use dangerous shell=True
+- Use subprocess.check_output() with a sequence of program arguments
+
 * Thu Jun 02 2016 Petr Lautrbach <plautrba@redhat.com> - 3.3.8.1-1
 - fixed get_all_alerts_ignored()
 
diff --git a/sources b/sources
index 1958423..88351e1 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-55bee877aae998a9694b3ed27d5561c9  setroubleshoot-3.3.8.1.tar.gz
+8f3cbb78e9f85fbd93cb604c7ce48f40  setroubleshoot-3.3.9.1.tar.gz