diff --git a/arpwatch.spec b/arpwatch.spec
index 9dc2385..082aaea 100644
--- a/arpwatch.spec
+++ b/arpwatch.spec
@@ -3,7 +3,7 @@
 Name: arpwatch
 Epoch: 14
 Version: 2.1a15
-Release: 19%{?dist}
+Release: 20%{?dist}
 Summary: Network monitoring tools for tracking IP addresses on a network
 Group: Applications/System
 License: BSD with advertising
@@ -34,6 +34,7 @@ Patch8: arpwatch-2.1a15-nolocalpcap.patch
 Patch9: arpwatch-2.1a15-bogon.patch
 Patch10: arpwatch-2.1a15-extraman.patch
 Patch11: arpwatch-exitcode.patch
+Patch12: arpwatch-2.1a15-dropgroup.patch
 
 %description
 The arpwatch package contains arpwatch and arpsnmp.  Arpwatch and
@@ -59,6 +60,7 @@ network.
 %patch9 -p1 -b .bogon
 %patch10 -p1 -b .extraman
 %patch11 -p1 -b .exitcode
+%patch12 -p1 -b .dropgroup
 
 %build
 %configure
@@ -151,6 +153,9 @@ fi
 %verify(not md5 size mtime) %config(noreplace) %{_vararpwatch}/ethercodes.dat
 
 %changelog
+* Thu May 31 2012 Aleš Ledvinka <aledvink@redhat.com> 14:2.1a15-20
+- fix supplementary group list (#825328) (CVE-2012-2653)
+
 * Thu Jan 19 2012 Jan Synáček <jsynacek@redhat.com> 14:2.1a15-19
 - Turn on PrivateTmp=true in service file (#782477)