diff --git a/gnutls-3.5.7.tar.xz b/gnutls-3.5.7.tar.xz
deleted file mode 100644
index 53dc258..0000000
--- a/gnutls-3.5.7.tar.xz
+++ /dev/null
@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:60cbfc119e6268cfa38d712621daa473298a0c5b129c0842caec4c1ed4d7861a
-size 7265264
diff --git a/gnutls-3.5.7.tar.xz.sig b/gnutls-3.5.7.tar.xz.sig
deleted file mode 100644
index 48e50f4..0000000
Binary files a/gnutls-3.5.7.tar.xz.sig and /dev/null differ
diff --git a/gnutls-3.5.8.tar.xz b/gnutls-3.5.8.tar.xz
new file mode 100644
index 0000000..4b7c9c6
--- /dev/null
+++ b/gnutls-3.5.8.tar.xz
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:0e97f243ae72b70307d684b84c7fe679385aa7a7a0e37e5be810193dcc17d4ff
+size 7264448
diff --git a/gnutls-3.5.8.tar.xz.sig b/gnutls-3.5.8.tar.xz.sig
new file mode 100644
index 0000000..1b78e43
Binary files /dev/null and b/gnutls-3.5.8.tar.xz.sig differ
diff --git a/gnutls.changes b/gnutls.changes
index 24ee85f..d13e020 100644
--- a/gnutls.changes
+++ b/gnutls.changes
@@ -1,4 +1,35 @@
 -------------------------------------------------------------------
+Mon Jan  9 10:07:19 UTC 2017 - meissner@suse.com
+
+- Version 3.5.8 (released 2016-01-09)
+  * libgnutls: Ensure that multiple calls to the gnutls_set_priority_*
+    functions will not leave the verification profiles field to an
+    undefined state. The last call will take precedence.
+  * libgnutls: Ensure that GNUTLS_E_DECRYPTION_FAIL will be returned
+    by PKCS#8 decryption functions when an invalid key is provided. This
+    addresses regression on decrypting certain PKCS#8 keys.
+  * libgnutls: Introduced option to override the default priority string
+    used by the library. The intention is to allow support of system-wide
+    priority strings (as set with --with-system-priority-file). The
+    configure option is --with-default-priority-string.
+  * libgnutls: Require a valid IV size on all ciphers for PKCS#8 decryption.
+    This prevents crashes when decrypting malformed PKCS#8 keys.
+  * libgnutls: Fix crash on the loading of malformed private keys with certain
+    parameters set to zero.
+  * libgnutls: Fix double free in certificate information printing. If the PKIX
+    extension proxy was set with a policy language set but no policy specified,
+    that could lead to a double free.
+  * libgnutls: Addressed memory leaks in client and server side error paths
+    (issues found using oss-fuzz project)
+  * libgnutls: Addressed memory leaks in X.509 certificate printing error paths
+    (issues found using oss-fuzz project)
+  * libgnutls: Addressed memory leaks and an infinite loop in OpenPGP certificate
+    parsing. Fixes by Alex Gaynor. (issues found using oss-fuzz project)
+  * libgnutls: Addressed invalid memory accesses in OpenPGP certificate parsing.
+    (issues found using oss-fuzz project)
+
+- security issues fixed: GNUTLS-SA-2017-1 GNUTLS-SA-2017-2
+-------------------------------------------------------------------
 Sun Dec 18 16:28:51 UTC 2016 - astieger@suse.com
 
 - GnuTLS 3.5.7, the next stable branch, with the following
diff --git a/gnutls.spec b/gnutls.spec
index 2c40e52..7086447 100644
--- a/gnutls.spec
+++ b/gnutls.spec
@@ -1,7 +1,7 @@
 #
 # spec file for package gnutls
 #
-# Copyright (c) 2016 SUSE LINUX GmbH, Nuernberg, Germany.
+# Copyright (c) 2017 SUSE LINUX GmbH, Nuernberg, Germany.
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -29,7 +29,7 @@
 %define gnutls_dane_sover 0
 %endif
 Name:           gnutls
-Version:        3.5.7
+Version:        3.5.8
 Release:        0
 Summary:        The GNU Transport Layer Security Library
 License:        LGPL-2.1+ and GPL-3.0+