diff --git a/.gitignore b/.gitignore
index 9f3e15d..83b5e37 100644
--- a/.gitignore
+++ b/.gitignore
@@ -100,3 +100,4 @@
 /389-ds-base-1.3.2.18.tar.bz2
 /389-ds-base-1.3.2.19.tar.bz2
 /389-ds-base-1.3.2.20.tar.bz2
+/389-ds-base-1.3.2.21.tar.bz2
diff --git a/389-ds-base.spec b/389-ds-base.spec
index c1282e3..cb5d7ce 100644
--- a/389-ds-base.spec
+++ b/389-ds-base.spec
@@ -24,7 +24,7 @@
 
 Summary:          389 Directory Server (base)
 Name:             389-ds-base
-Version:          1.3.2.20
+Version:          1.3.2.21
 Release:          %{?relprefix}1%{?prerel}%{?dist}
 License:          GPLv2 with exceptions
 URL:              http://port389.org/
@@ -316,6 +316,16 @@ fi
 %{_libdir}/%{pkgname}/libns-dshttpd.so*
 
 %changelog
+* Thu Aug 07 2014 Noriko Hosoi <nhosoi@redhat.com> - 1.3.2.21-1
+- Release 1.3.2.21
+- Resolves: #1127833
+            Ticket 47869 - unauthenticated information disclosure (Bug 1123477)
+- Ticket 47834 - Tombstone_to_glue: if parents are also converted to glue, the target entry's DN must be adjusted.
+- Ticket 47862 - repl-monitor fails to convert "*" to default values
+- Ticket 47824 - paged results control is not working in some cases when we have a subsuffix.
+- Ticket 47862 - Repl-monitor.pl ignores the provided connection parameters
+- Ticket 346   - Fixing memory leaks
+
 * Tue Jul 22 2014 Noriko Hosoi <nhosoi@redhat.com> - 1.3.2.20-1
 - Release 1.3.2.20
 - Ticket 47753 - Add switch to disable pre-hashed password checking
diff --git a/sources b/sources
index 27909b3..946e945 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-96b4086fca20d5b651286c469b41e8c8  389-ds-base-1.3.2.20.tar.bz2
+d25ce375daea1831fedca7fd282bbbf0  389-ds-base-1.3.2.21.tar.bz2