diff --git a/.gitignore b/.gitignore
index e6fedc6..572f7a9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -142,3 +142,4 @@
 /389-ds-base-1.3.5.15.tar.bz2
 /389-ds-base-1.3.5.16.tar.bz2
 /389-ds-base-1.3.6.3.tar.bz2
+/389-ds-base-1.3.5.17.tar.bz2
diff --git a/389-ds-base.spec b/389-ds-base.spec
index 9017b6f..8efe0c8 100644
--- a/389-ds-base.spec
+++ b/389-ds-base.spec
@@ -33,7 +33,7 @@
 
 Summary:          389 Directory Server (base)
 Name:             389-ds-base
-Version:          1.3.5.16
+Version:          1.3.5.17
 Release:          %{?relprefix}1%{?prerel}%{?dist}
 License:          GPLv3+
 URL:              http://www.port389.org/
@@ -454,6 +454,15 @@ fi
 %{_sysconfdir}/%{pkgname}/dirsrvtests
 
 %changelog
+* Fri Apr 21 2017 Mark Reynolds <mreynolds@redhat.com> - 1.3.5.17-1
+- Bump version to 1.3.5.17
+- Issue 49221 - During an upgrade the provided localhost name is ignored
+- Issue 49220 - Fix for cve 2017-2668 - Remote crash via crafted LDAP messages
+- Issue 49210 - Fix regression when checking is password min  age should be checked
+- Issue 49205 - Fix logconv.pl man page
+- Issue 49035 - dbmon.sh shows pages-in-use that exceeds the cache size
+- Issue 49039 - password min age should be ignored if password needs to be reset
+
 * Wed Mar 22 2017 Mark Reynolds <mreynolds@redhat.com> - 1.3.5.16-1
 - Bump version to 1.3.5.16-1
 - Issue 49188 - retrocl can crash server at shutdown
diff --git a/sources b/sources
index 7f42600..0f7574f 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
 SHA512 (nunc-stans-0.1.8.tar.bz2) = a32c3526cf977990ea0879e3ea10c413f46d6d60563f886c86d84819553b25a5daecc14af8db5dd2274ec9cebe70da7b3a2db322d489bbd5155407d05dc0422d
-SHA512 (389-ds-base-1.3.5.16.tar.bz2) = bcf96350f6a5b7e689f40d7810c72974cdc21c4a5a99fe39fa30c8498334d4629ad198f128dcd6800c8f0132393d4efe4fe27561873afe0f1e9a9673953436dd
+SHA512 (389-ds-base-1.3.5.17.tar.bz2) = 5b96b19cea7dc80c64eaade31127d04c228f7e4dc1999ec19b341cf080ee4570757c84e8dae151c2cb3bcebe1398d50238d74ca362ce07fceafcb66fba590833