diff --git a/p11-kit-0.23.20.tar.xz b/p11-kit-0.23.20.tar.xz
deleted file mode 100644
index 760481f..0000000
--- a/p11-kit-0.23.20.tar.xz
+++ /dev/null
@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:14d86024c3dfd6b967d9bc0b4ec7b2973014fe7423481f4d230a1a63b8aa6104
-size 822588
diff --git a/p11-kit-0.23.20.tar.xz.sig b/p11-kit-0.23.20.tar.xz.sig
deleted file mode 100644
index adad05f..0000000
Binary files a/p11-kit-0.23.20.tar.xz.sig and /dev/null differ
diff --git a/p11-kit-0.23.22.tar.xz b/p11-kit-0.23.22.tar.xz
new file mode 100644
index 0000000..45a14f4
--- /dev/null
+++ b/p11-kit-0.23.22.tar.xz
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:8a8f40153dd5a3f8e7c03e641f8db400133fb2a6a9ab2aee1b6d0cb0495ec6b6
+size 830016
diff --git a/p11-kit-0.23.22.tar.xz.sig b/p11-kit-0.23.22.tar.xz.sig
new file mode 100644
index 0000000..70497e6
Binary files /dev/null and b/p11-kit-0.23.22.tar.xz.sig differ
diff --git a/p11-kit.changes b/p11-kit.changes
index af33eca..46ac2bb 100644
--- a/p11-kit.changes
+++ b/p11-kit.changes
@@ -1,3 +1,19 @@
+-------------------------------------------------------------------
+Sun Jan 17 23:39:49 UTC 2021 - Dirk Müller <dmueller@suse.com>
+
+- update to 0.23.22 (bsc#1180064, bsc#1180065, bsc#1180066):
+ * Fix memory-safety issues that affect the RPC protocol
+   (CVE-2020-29361, CVE-2020-29362, and CVE-2020-29363), discovered
+   and fixed by David Cook
+ * anchor: Prefer persistent format when storing anchor [PR#329]
+ * common: Fix infloop in p11_path_build [PR#326, PR#327]
+ * proxy: C_CloseAllSessions: Make sure that calloc args are non-zero [PR#325]
+ * common: Check for a NULL locale before freeing it [PR#321]
+ * proxy: Do not assign duplicate slot IDs [PR#282]
+ * common: Get program name based on executable path if possible [PR#307]
+ * anchor: Exit with non-zero code, if any error occurs [PR#304]
+ * Build and test fixes
+
 -------------------------------------------------------------------
 Mon Oct  5 13:19:09 UTC 2020 - Ludwig Nussel <lnussel@suse.de>
 
diff --git a/p11-kit.spec b/p11-kit.spec
index 7a4bd86..a9571f4 100644
--- a/p11-kit.spec
+++ b/p11-kit.spec
@@ -1,7 +1,7 @@
 #
 # spec file for package p11-kit
 #
-# Copyright (c) 2020 SUSE LLC
+# Copyright (c) 2021 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -21,7 +21,7 @@
 %define trustdir_cfg     %{pkidir_cfg}/trust
 %define trustdir_static  %{pkidir_static}/trust
 Name:           p11-kit
-Version:        0.23.20
+Version:        0.23.22
 Release:        0
 Summary:        Library to work with PKCS#11 modules
 License:        BSD-3-Clause
@@ -134,14 +134,12 @@ ln -s ../../sbin/update-ca-certificates %{buildroot}%{_libexecdir}/%{name}/p11-k
 export NO_BRP_STALE_LINK_ERROR=yes # *grr*
 
 %check
-make %{?_smp_mflags} check
+%make_build check
 
 %post -n libp11-kit0 -p /sbin/ldconfig
-
 %postun -n libp11-kit0 -p /sbin/ldconfig
 
 %files
-%defattr(-,root,root)
 %dir %{_libdir}/pkcs11
 %dir %{_datadir}/%{name}
 %dir %{_datadir}/%{name}/modules
@@ -160,7 +158,6 @@ make %{?_smp_mflags} check
 %{_libexecdir}/%{name}/p11-kit-extract-trust
 
 %files -n libp11-kit0
-%defattr(-,root,root)
 %license COPYING
 # Package the example conf file as documentation. Like this we're sure that we will
 # not introduce conflicts with this version of the library and future ones.
@@ -172,15 +169,13 @@ make %{?_smp_mflags} check
 %{_libdir}/p11-kit-proxy.so
 
 %files tools
-%defattr(-,root,root)
 %{_bindir}/p11-kit
 %{_bindir}/trust
-%{_mandir}/man1/trust.1.gz
-%{_mandir}/man5/pkcs11.conf.5.gz
-%{_mandir}/man8/p11-kit.8.gz
+%{_mandir}/man1/trust.1%{?ext_man}
+%{_mandir}/man5/pkcs11.conf.5%{?ext_man}
+%{_mandir}/man8/p11-kit.8%{?ext_man}
 
 %files devel
-%defattr(-,root,root)
 %{_rpmmacrodir}/macros.%{name}
 %{_includedir}/p11-kit-1/
 %{_libdir}/libp11-kit.so
@@ -190,7 +185,6 @@ make %{?_smp_mflags} check
 %doc %{_datadir}/gtk-doc/html/p11-kit/
 
 %files nss-trust
-%defattr(-,root,root)
 %{_libdir}/libnssckbi.so
 
 %files server