diff --git a/libzypp-17.18.1.tar.bz2 b/libzypp-17.18.1.tar.bz2
deleted file mode 100644
index deda98d..0000000
--- a/libzypp-17.18.1.tar.bz2
+++ /dev/null
@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:d72fe2c19297ecbdb54baa332f2caaab5fac815185ac09277e39beaea59cd3b1
-size 4742907
diff --git a/libzypp-17.19.0.tar.bz2 b/libzypp-17.19.0.tar.bz2
new file mode 100644
index 0000000..a56e35d
--- /dev/null
+++ b/libzypp-17.19.0.tar.bz2
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:1d9e280de3967bc1837569ed93a8963d591f34830e27ba51e35652af0d91c4f4
+size 4743483
diff --git a/libzypp.changes b/libzypp.changes
index 6565acd..b1d67a2 100644
--- a/libzypp.changes
+++ b/libzypp.changes
@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Wed Dec 11 09:51:10 CET 2019 - ma@suse.de
+
+- MediaCurl: assert cookie file has mode 0600 (bsc#1158763, CVE-2019-18900)
+- version 17.19.0 (12)
+
 -------------------------------------------------------------------
 Mon Dec  9 10:22:56 CET 2019 - ma@suse.de
 
diff --git a/libzypp.spec b/libzypp.spec
index 5c11876..5e45ea5 100644
--- a/libzypp.spec
+++ b/libzypp.spec
@@ -17,7 +17,7 @@
 
 
 Name:           libzypp
-Version:        17.18.1
+Version:        17.19.0
 Release:        0
 Url:            https://github.com/openSUSE/libzypp
 Summary:        Library for package, patch, pattern and product management