diff --git a/.cvsignore b/.cvsignore
index e4b9394..2389d2d 100644
--- a/.cvsignore
+++ b/.cvsignore
@@ -1 +1 @@
-apr-1.3.7.tar.bz2
+apr-1.3.8.tar.bz2
diff --git a/apr-1.3.7.tar.bz2.asc b/apr-1.3.7.tar.bz2.asc
deleted file mode 100644
index a4247c1..0000000
--- a/apr-1.3.7.tar.bz2.asc
+++ /dev/null
@@ -1,7 +0,0 @@
------BEGIN PGP SIGNATURE-----
-Version: GnuPG v1.4.9 (Darwin)
-
-iD8DBQBKZM2QizpgHwjJdeURAmknAJ9PLh15rpO66j/gyktJrLwOS9OYTACfYpjW
-BTz/S/WhcOABHHTczdwgydU=
-=Y8Lw
------END PGP SIGNATURE-----
diff --git a/apr-1.3.8.tar.bz2.asc b/apr-1.3.8.tar.bz2.asc
new file mode 100644
index 0000000..fb92e73
--- /dev/null
+++ b/apr-1.3.8.tar.bz2.asc
@@ -0,0 +1,17 @@
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v1.4.9 (GNU/Linux)
+
+iQIcBAABAgAGBQJKeKEWAAoJEKNIuYR/chSn7NUP/iaCorqo2mTGAdW/VJO6sFWZ
+tR874sJPL4/y4bl8OQ9QttDm220u3iApJHps3DtH7lD95OEYJ9p+lAAbiJF+frkj
+8cNorwiH+eHu6yzVmjaYi4svIzEnvqugjdG2jJ3mckjLcM6Xz/JalS0iVpl/hpti
+MZ/HNtPOyjECDN5RQT86cfUboWjwvQb5awXkzdtI9+58xJZ4piDxPexBVud7Eelo
+Ax6UD8gfGXpkloYLFK+cujwYZDKPO6CrizSWULo3Gm/6a/7D3jZCmcmBM4JVexMd
+Umy3KDHBmkE0TEKbEuxoHNOgLT8gI4BnLyt6OGPQHTaY2jjH2TRDLjw/WOYDAR9d
+qYOEWsF4pHwOs2I2IOZI1x5dzBHnajRIxPsd3dEK/pmrKJEccoOOPrq1hNCdiKPp
+9/zLJ8fMoqkxTvPkQQLjSYu3BMLRuK5ET+ULP4Rd+C8zAfztpJigHb7Qxnzi54d3
+oqUqBkSG88IWWn+s9IMmUGem7f9m/9kVfmSSWz7KMsJo3i8Jd8FaGLNsnh7v3qMg
+V9uUof8BaPnFrsX5j7zPyvFv1uYH4FMQKRoxjlvQ26s+jn6H78lncRmDiUT7dsJy
+BGI+1AT/CcIBHrD+UeJtQ26KcAWPnOama7kJgfgdqXbJV4Wp6Pm1ItB668x5ToHk
+GQGu/3OxUAALS20RWacr
+=a7Bb
+-----END PGP SIGNATURE-----
diff --git a/apr.spec b/apr.spec
index 593bbe7..3291ac3 100644
--- a/apr.spec
+++ b/apr.spec
@@ -5,8 +5,8 @@
 
 Summary: Apache Portable Runtime library
 Name: apr
-Version: 1.3.7
-Release: 2%{?dist}
+Version: 1.3.8
+Release: 1%{?dist}
 License: ASL 2.0
 Group: System Environment/Libraries
 URL: http://apr.apache.org/
@@ -127,6 +127,11 @@ rm -rf $RPM_BUILD_ROOT
 %{_datadir}/aclocal/*.m4
 
 %changelog
+* Thu Aug  6 2009 Bojan Smojver <bojan@rexursive.com> - 1.3.8-1
+- bump up to 1.3.8
+- CVE-2009-2412
+- allocator alignment fixes
+
 * Sun Jul 26 2009 Bojan Smojver <bojan@rexursive.com> - 1.3.7-2
 - include apr_cv_sock_cloexec too
 
diff --git a/sources b/sources
index ff5db3f..4b59290 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-1414f695a236a2bf8e470ca624d6a2e8  apr-1.3.7.tar.bz2
+3c7e3a39ae3d3573f49cb74e2dbf87a2  apr-1.3.8.tar.bz2