diff --git a/.git.metadata b/.git.metadata
index 42df035..ccb05e4 100644
--- a/.git.metadata
+++ b/.git.metadata
@@ -1,2 +1,2 @@
-c57084d534cc259c14371a4dbdaf0119933d8f41 SOURCES/git-2.18.1.tar.xz
+db4ceed18908aafcdc563156d8c1cfd0bb3ae738 SOURCES/git-2.18.2.tar.xz
 097b8da13939ac9f51f97a5659184c1d96fb0973 SOURCES/gpgkey-junio.asc
diff --git a/.gitignore b/.gitignore
index d32ef2a..3a3eec6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,2 @@
-SOURCES/git-2.18.1.tar.xz
+SOURCES/git-2.18.2.tar.xz
 SOURCES/gpgkey-junio.asc
diff --git a/SOURCES/git-2.18.1.tar.sign b/SOURCES/git-2.18.1.tar.sign
deleted file mode 100644
index d2d8e10..0000000
Binary files a/SOURCES/git-2.18.1.tar.sign and /dev/null differ
diff --git a/SOURCES/git-2.18.2.tar.sign b/SOURCES/git-2.18.2.tar.sign
new file mode 100644
index 0000000..8abd6c9
Binary files /dev/null and b/SOURCES/git-2.18.2.tar.sign differ
diff --git a/SPECS/git.spec b/SPECS/git.spec
index 00698f8..7682b74 100644
--- a/SPECS/git.spec
+++ b/SPECS/git.spec
@@ -102,8 +102,8 @@
 #global rcrev   .rc0
 
 Name:           %{?scl_prefix}git
-Version:        2.18.1
-Release:        4%{?rcrev}%{?dist}
+Version:        2.18.2
+Release:        1%{?rcrev}%{?dist}
 Summary:        Fast Version Control System
 License:        GPLv2
 URL:            https://git-scm.com/
@@ -961,6 +961,13 @@ make test || ./print-failed-test-output
 %{?with_docs:%{_pkgdocdir}/git-instaweb.html}
 
 %changelog
+* Tue Dec 17 2019 Ondrej Pohorelsky <opohorel@redhat.com> - 2.18.2-1
+- Update to release 2.18.2
+- Remote code execution in recursive clones with nested submodules
+  Resolves: CVE-2019-1387
+- Fixes CVE-2019-1348, CVE-2019-1349, CVE-2019-1350, CVE-2019-1351,
+  CVE-2019-1352, CVE-2019-1353, CVE-2019-1354
+
 * Tue Jun 11 2019 Marcel Plch <mplch@redhat.com> - 2.18.1-4
 - Use HMAC from libcrypto instead of git's implementation
 - Resolves: rhbz#1619113