Update SQLite to 3.31.1 in Windows and macOS installer builds

[BigStone]

BPO	38380
Nosy	@pfmoore, @ronaldoussoren, @tjguk, @benjaminp, @ned-deily, @zware, @zooba, @miss-islington, @erlend-aasland
PRs	bpo-38380: Update macOS & Windows builds to SQLite v3.31.1 #18678 [3.8] bpo-38380: Update macOS & Windows builds to SQLite v3.31.1 (GH-18678) #18740 [3.7] bpo-38380: Update macOS & Windows builds to SQLite v3.31.1 (GH-18678) #18741
Files	0001-bpo-38380-Update-macOS-installer-to-use-SQLite-3.30..patch: bpo-38380: Update macOS installer to use SQLite 3.30.0 0002-bpo-38380-Update-Windows-builds-to-use-SQLite-3.30.0.patch: bpo-38380: Update Windows builds to use SQLite 3.30.0 0001-bpo-38380-Update-macOS-installer-to-use-SQLite-3.30.1.patch 0002-bpo-38380-Update-Windows-builds-to-use-SQLite-3.30.1.patch

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2020-03-04.02:45:36.925>
created_at = <Date 2019-10-05.22:12:20.397>
labels = ['OS-mac', '3.7', '3.8', '3.9', 'build', 'OS-windows']
title = 'Update SQLite to 3.31.1 in Windows and macOS installer builds'
updated_at = <Date 2020-03-04.02:45:36.924>
user = 'https://bugs.python.org/BigStone'

bugs.python.org fields:

activity = <Date 2020-03-04.02:45:36.924>
actor = 'benjamin.peterson'
assignee = 'none'
closed = True
closed_date = <Date 2020-03-04.02:45:36.925>
closer = 'benjamin.peterson'
components = ['Build', 'macOS', 'Windows']
creation = <Date 2019-10-05.22:12:20.397>
creator = 'Big Stone'
dependencies = []
files = ['48651', '48652', '48921', '48922']
hgrepos = []
issue_num = 38380
keywords = ['patch']
message_count = 30.0
messages = ['354023', '354025', '354280', '354281', '354282', '354284', '354300', '362803', '362923', '362928', '362929', '362930', '362933', '362935', '362938', '362963', '362970', '362973', '363144', '363156', '363158', '363160', '363161', '363162', '363166', '363178', '363179', '363180', '363182', '363323']
nosy_count = 10.0
nosy_names = ['paul.moore', 'ronaldoussoren', 'tim.golden', 'benjamin.peterson', 'ned.deily', 'zach.ware', 'steve.dower', 'Big Stone', 'miss-islington', 'erlendaasland']
pr_nums = ['18678', '18740', '18741']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = None
url = 'https://bugs.python.org/issue38380'
versions = ['Python 2.7', 'Python 3.7', 'Python 3.8', 'Python 3.9']

[BigStone]

there is a security fix in sqlite-3.30

https://nvd.nist.gov/vuln/detail/CVE-2019-16168#VulnChangeHistorySection

https://www.sqlite.org/releaselog/3_30_0.html

[ned-deily]

I verified it is exploitable via the sqlite3 module by adapting the test case from the SQLite ticket (https://www.sqlite.org/src/info/e4598ecbdd18bd82). But since it requires the exploiter to be able to specify raw SQL statements, it doesn't sound like it needs to be treated as a Python security issue. We should plan to to update to the latest SQLite but it doesn't need to be a release blocker.

[erlend-aasland]

I've prepared a PR for https://github.com/python/cpython-source-deps at https://github.com/erlend-aasland/cpython-source-deps/tree/upgrade-sqlite.

Patches for Windows and macOS installer builds on 3.9 prepared at https://github.com/erlend-aasland/cpython/tree/fix-issue-38380.

If it looks ok, I'll create PR's for CPython and cpython-source-deps. I guess this should be backported to 3.8, 3.7 and 2.7.

[erlend-aasland]

bpo-38380: Update macOS installer to use SQLite 3.30.0
erlend-aasland@aa7d7b1

[erlend-aasland]

bpo-38380: Update Windows builds to use SQLite 3.30.0
erlend-aasland@e25214e

[erlend-aasland]

FYI: Compiled cpython 3.9 with sqlite-3.30 on macOS 10.14.6. Make test completes without errors.

[erlend-aasland]

Update: Tested on macOS 10.14.6 with make test on 2.7.17rc1, 3.7.5rc1+, 3.8.0rc1+.

[erlend-aasland]

I've updated these patches to sqlite3-3.30.1 (https://www.sqlite.org/releaselog/3_30_1.html).

cpython-source-deps is updated (python/cpython-source-deps#17).

CPython commits are updated and rebased onto current 3.9 master: https://github.com/erlend-aasland/cpython/tree/fix-issue-38380

(Since Oct 2019, SQLite 3.31 have been released, but that would probably require opening a new issue.)

[zooba]

We still need the tag added to the cpython-source-deps repo, and I still can't complete a clone right now (something is strange with SSL to GitHub on my (temporary) internet connection).

Zach - can you tag it? python/cpython-source-deps#17