diff --git a/.gitignore b/.gitignore
index 78dd1f3..474af1a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -223,3 +223,5 @@ samba-3.6.0pre1.tar.gz
 /samba-4.13.0rc6.tar.asc
 /samba-4.13.0.tar.xz
 /samba-4.13.0.tar.asc
+/samba-4.13.1.tar.xz
+/samba-4.13.1.tar.asc
diff --git a/samba.spec b/samba.spec
index 9841740..7d11a1c 100644
--- a/samba.spec
+++ b/samba.spec
@@ -78,9 +78,9 @@
 
 %define samba_requires_eq()  %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not")
 
-%global main_release 14
+%global main_release 0
 
-%global samba_version 4.13.0
+%global samba_version 4.13.1
 %global talloc_version 2.3.1
 %global tdb_version 1.4.3
 %global tevent_version 0.10.2
@@ -3761,6 +3761,12 @@ fi
 %endif
 
 %changelog
+* Thu Oct 29 2020 Guenther Deschner <gdeschner@redhat.com> - 4.13.1-0
+- Update to Samba 4.13.1
+- resolves: #1892631, #1892634 - Security fixes for CVE-2020-14318
+- resolves: #1891685, #1892628 - Security fixes for CVE-2020-14323
+- resolves: #1892636, #1892640 - Security fixes for CVE-2020-14383
+
 * Mon Oct 26 2020 Andreas Schneider <asn@redhat.com> - 4.13.0-14
 - Fixed dbcheck running in a release tarball
 - Updated internal resolv_wrapper copy to verison 1.1.7
diff --git a/sources b/sources
index 36e8498..3dda01b 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (samba-4.13.0.tar.xz) = 38370adfad7b7a9a8633d48782f0bcf812299858be20770d2e3406c7f450a2fd1ae646e2a143d22ce3c5ac22d54c4a229b019686ff2f16ca503c958d4afed825
-SHA512 (samba-4.13.0.tar.asc) = 7f71d1402d752cbdb09ec9e2539d35347c4025c332c4acb8590d5cab190b2b23bc2b1f99f3d66c3488bbdb6898528dd78e3893c33c92e3d9167236e8048dfbf2
+SHA512 (samba-4.13.1.tar.xz) = 251664d53eb4a53509a3032d3519b11ddd07231887ec7a1965d20bae92bb03e0dc63898aef0bb7565de66c77e9cbc34fcf42a078190c97425c3662c5da4d5480
+SHA512 (samba-4.13.1.tar.asc) = 1ead1ae10f4d25a1f43842e31eb24ecfa1e0076b48a8b7c57d9286f7162d4b0c12cf29de6526447f16c60e04cb5f07105bdc0b48a51d72e63cc8cc9fe7782b01