diff --git a/.gitignore b/.gitignore
index af59285..c5598ea 100644
--- a/.gitignore
+++ b/.gitignore
@@ -365,3 +365,4 @@ network-manager-applet-0.8.1.tar.bz2
 /NetworkManager-1.20.6.tar.xz
 /NetworkManager-1.20.8.tar.xz
 /NetworkManager-1.20.10.tar.xz
+/NetworkManager-1.20.12.tar.xz
diff --git a/NetworkManager.spec b/NetworkManager.spec
index b54ce48..31939f6 100644
--- a/NetworkManager.spec
+++ b/NetworkManager.spec
@@ -5,8 +5,8 @@
 %global glib2_version %(pkg-config --modversion glib-2.0 2>/dev/null || echo bad)
 
 %global epoch_version 1
-%global rpm_version 1.20.10
-%global real_version 1.20.10
+%global rpm_version 1.20.12
+%global real_version 1.20.12
 %global release_version 1
 %global snapshot %{nil}
 %global git_sha %{nil}
@@ -21,10 +21,10 @@
 
 %global _hardened_build 1
 
-%if "x%{?snapshot}" != x
+%if "x%{?snapshot}" != "x"
 %global snapshot_dot .%{snapshot}
 %endif
-%if "x%{?git_sha}" != x
+%if "x%{?git_sha}" != "x"
 %global git_sha_dot .%{git_sha}
 %endif
 
@@ -109,9 +109,9 @@
 # bpf(BPF_MAP_CREATE, ...) randomly fails with EPERM. That might
 # be related to `ulimit -l`. Anyway, this is not usable at the
 # moment.
-%global ebpf_enabled no
+%global ebpf_enabled "no"
 %else
-%global ebpf_enabled no
+%global ebpf_enabled "no"
 %endif
 
 ###############################################################################
@@ -454,7 +454,7 @@ configurations using "/etc/sysconfig/network-scripts/rule-NAME" files
 (eg, to do policy-based routing).
 
 
-%if 0%{with_nmtui}
+%if %{with nmtui}
 %package tui
 Summary: NetworkManager curses-based UI
 Group: System Environment/Base
@@ -521,6 +521,11 @@ by nm-connection-editor and nm-applet in a non-graphical environment.
 	-Diwd=true \
 %else
 	-Diwd=false \
+%endif
+%if %{with nmtui}
+	-Dnmtui=true \
+%else
+	-Dnmtui=false \
 %endif
 	-Dvapi=true \
 	-Dintrospection=true \
@@ -549,7 +554,7 @@ by nm-connection-editor and nm-applet in a non-graphical environment.
 %else
 	-Dlibpsl=false \
 %endif
-%if %{ebpf_enabled} != yes
+%if %{ebpf_enabled} != "yes"
 	-Debpf=false \
 %else
 	-Debpf=true \
@@ -637,6 +642,11 @@ intltoolize --automake --copy --force
 	--with-iwd=yes \
 %else
 	--with-iwd=no \
+%endif
+%if %{with nmtui}
+	--with-nmtui=yes \
+%else
+	--with-nmtui=no \
 %endif
 	--enable-vala=yes \
 	--enable-introspection \
@@ -692,7 +702,7 @@ intltoolize --automake --copy --force
 
 make %{?_smp_mflags}
 
-%endif # end autotools
+%endif
 
 %install
 %if %{with meson}
@@ -750,7 +760,7 @@ make -k %{?_smp_mflags} check
 %else
 make -k %{?_smp_mflags} check || :
 %endif
-%endif # end autotools
+%endif
 
 
 %pre
@@ -972,6 +982,10 @@ fi
 
 
 %changelog
+* Fri May 29 2020 Thomas Haller <thaller@redhat.com> - 1:1.20.12-1
+- Update to 1.20.12 release
+- ifcfg-rh: handle "802-1x.{,phase2-}ca-path" (rh #1841395, CVE-2020-10754)
+
 * Mon Jan 13 2020 Antonio Cardace <acardace@redhat.com> - 1:1.20.10-1
 - Update to 1.20.10 release
 
diff --git a/sources b/sources
index e2289fe..1e3d04c 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (NetworkManager-1.20.10.tar.xz) = a239b49dc73d464d87d5021c5a27396103b262d63bb8669209e187b9145fea18bedf9a1adc42d3ff1437b1d087a95b830bf8ed335a2aa10eec794f031c809793
+SHA512 (NetworkManager-1.20.12.tar.xz) = 97dacee9b0720b864c941c139579d84d98d1b2f74dfc97fd0a6ed35ed9ae0b45d40553f8d79c4d7c4d3958228a2e6035555069c94040ecbe4a34457bce8d5f60