diff --git a/.gitignore b/.gitignore
index 2f023da..37ee9ae 100644
--- a/.gitignore
+++ b/.gitignore
@@ -44,3 +44,4 @@ unbound-1.4.5.tar.gz
 /unbound-1.6.4.tar.gz
 /unbound-1.6.6.tar.gz
 /unbound-1.6.7.tar.gz
+/unbound-1.6.8.tar.gz
diff --git a/sources b/sources
index 316348a..fb39f26 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (unbound-1.6.7.tar.gz) = 6e3d1a057081252183343d0d1b8ace742ab15e8f5244e61287340f49289d7449bed93fbfdaa3194c0e99ca23948f4b33038f75af5c5b26c938004d06fc3031e0
+SHA512 (unbound-1.6.8.tar.gz) = 653d88d5dbc8cf25f7261e4a9869b6591843c7ff27b5d63f979a94505daafbbb61e05d46bedd2d01230355d5f08dd9fe14ed04c5c7340f3f27581b61ad6edfa3
diff --git a/unbound.spec b/unbound.spec
index ea1c13c..08096ee 100644
--- a/unbound.spec
+++ b/unbound.spec
@@ -20,8 +20,8 @@
 
 Summary: Validating, recursive, and caching DNS(SEC) resolver
 Name: unbound
-Version: 1.6.7
-Release: 2%{?extra_version:.%{extra_version}}%{?dist}
+Version: 1.6.8
+Release: 1%{?extra_version:.%{extra_version}}%{?dist}
 License: BSD
 Url: https://www.unbound.net/
 Source: https://www.unbound.net/downloads/%{name}-%{version}%{?extra_version}.tar.gz
@@ -385,9 +385,7 @@ popd
 %{_sbindir}/unbound-control
 %{_sbindir}/unbound-control-setup
 %{_sbindir}/unbound-host
-#%if 0%{with_python3}
 %{_sbindir}/unbound-streamtcp
-#%endif
 %{_mandir}/man1/*
 %{_mandir}/man5/*
 %exclude %{_mandir}/man8/unbound-anchor*
@@ -439,6 +437,11 @@ popd
 %attr(0644,root,root) %config %{_sysconfdir}/%{name}/root.key
 
 %changelog
+* Mon Jan 22 2018 Paul Wouters <pwouters@redhat.com> - 1.6.8-1
+- Resolves rhbz#1483572 unbound-1.6.8 is available
+- Resolves rhbz#1507049 CVE-2017-15105 unbound: Improper validation of wildcard synthesized NSEC records
+- Resolves rhbz#1536518 CVE-2017-15105 unbound: Improper validation of wildcard synthesized NSEC records [fedora-all]
+
 * Sun Dec 17 2017 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.6.7-2
 - Python 2 binary package renamed to python2-unbound
   See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3