diff --git a/.gitignore b/.gitignore
index db535c0..dfd532e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,6 @@
 /chrony-3.5.tar.gz
 /chrony-3.5-tar-gz-asc.txt
 /clknetsim-79ffe4.tar.gz
+/chrony-3.5.1.tar.gz
+/chrony-3.5.1-tar-gz-asc.txt
+/clknetsim-c4ccc2.tar.gz
diff --git a/chrony.spec b/chrony.spec
index e102c8f..71cf4b3 100644
--- a/chrony.spec
+++ b/chrony.spec
@@ -1,10 +1,10 @@
 %global _hardened_build 1
-%global clknetsim_ver 79ffe4
+%global clknetsim_ver c4ccc2
 %bcond_without debug
 
 Name:           chrony
-Version:        3.5
-Release:        8%{?dist}
+Version:        3.5.1
+Release:        1%{?dist}
 Summary:        An NTP client/server
 
 License:        GPLv2
@@ -197,6 +197,9 @@ fi
 %dir %attr(-,chrony,chrony) %{_localstatedir}/log/chrony
 
 %changelog
+* Thu Aug 20 2020 Miroslav Lichvar <mlichvar@redhat.com> 3.5.1-1
+- update to 3.5.1 (CVE-2020-14367)
+
 * Tue Jan 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.5-8
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
 
diff --git a/sources b/sources
index 4cc2cf2..2a164d1 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (chrony-3.5.tar.gz) = c4f6376a44d71b6ac2b6d86e3d6fb4348642faeef7f3f3a4d6431627b5645efcc868b005cc398c8292bc3b63a1161fbd1a042c6ac2a0595843f908fe32eed90c
-SHA512 (chrony-3.5-tar-gz-asc.txt) = b66ccc22fb7ae2f0597b5e20705a71f0d7fabad396d6efc427f49247361a09e3b13e2af31460123451268268d663a181361769795758c4ee96ade2b24e31ba48
-SHA512 (clknetsim-79ffe4.tar.gz) = ae118c0e5fbb26d57489eba941b57593454bd41b714e305ed76f78b2eb469b59b6c14cd1781e8eda42895199294bb577ca3b6895a7d120d6b8dd6db4e08c1396
+SHA512 (chrony-3.5.1.tar.gz) = 489cf614bfb2c1e024343af1316c339b287ed5c7b6cec15b44ef3d90512036fb1da3fd627d291a193c59d9c5c095afa66c529eeb6fd0c1bbc8256ed8873b7984
+SHA512 (chrony-3.5.1-tar-gz-asc.txt) = 9ed9f66f1e338edd34c62afe9bd907c7ce13d78109c1270323e8879ad244e6164b9f357be9672f03e37b582abe07e3802748868e53daed6a3949ac7ffa271a06
+SHA512 (clknetsim-c4ccc2.tar.gz) = d2f71b2036e33ee92cd3590079dac04bc57bf2e9909f11e9ba66cd61c9946e92d2ebbdfd03c359cf39c6c8c07b28557d35fee3cb57eec75f5b1201858aa1d701