Update Windows installer to use bzip2 1.0.8

[ssmahato]

BPO	44549
Nosy	@pfmoore, @ronaldoussoren, @tjguk, @ned-deily, @ambv, @zware, @zooba, @animalize, @corona10, @pablogsal
PRs	bpo-44549: Update Windows installer to use BZip2 1.0.8 #27239 bpo-44549: Update macOS installer to use bzip2 1.0.8 #27241 bpo-44549: Update bzip2 to 1.0.8 in Windows builds to mitigate CVE-2016-3189 and CVE-2019-12900 #31731 [3.10] bpo-44549: Update bzip2 to 1.0.8 in Windows builds to mitigate CVE-2016-3189 and CVE-2019-12900 (GH-31731) #31732 [3.9] bpo-44549: Update bzip2 to 1.0.8 in Windows builds to mitigate CVE-2016-3189 and CVE-2019-12900 (GH-31732) #31733 [3.8] bpo-44549: Update bzip2 to 1.0.8 in Windows builds to mitigate CVE-2016-3189 and CVE-2019-12900 (GH-31732) #31734 [3.7] bpo-44549: Update bzip2 to 1.0.8 in Windows builds to mitigate CVE-2016-3189 and CVE-2019-12900 (GH-31732) #31735

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = 'https://github.com/zooba'
closed_at = <Date 2022-03-08.13:30:36.844>
created_at = <Date 2021-07-02.10:46:07.548>
labels = ['OS-mac', '3.8', '3.9', 'release-blocker', '3.7', 'type-security', '3.10', '3.11', 'OS-windows']
title = 'Update Windows installer to use bzip2 1.0.8'
updated_at = <Date 2022-03-08.13:30:36.844>
user = 'https://bugs.python.org/ssmahato'

bugs.python.org fields:

activity = <Date 2022-03-08.13:30:36.844>
actor = 'steve.dower'
assignee = 'steve.dower'
closed = True
closed_date = <Date 2022-03-08.13:30:36.844>
closer = 'steve.dower'
components = ['macOS', 'Windows']
creation = <Date 2021-07-02.10:46:07.548>
creator = 's.s.mahato'
dependencies = []
files = []
hgrepos = []
issue_num = 44549
keywords = ['patch']
message_count = 14.0
messages = ['396853', '396966', '397752', '397811', '397813', '397853', '397854', '414686', '414687', '414690', '414693', '414695', '414697', '414734']
nosy_count = 11.0
nosy_names = ['paul.moore', 'ronaldoussoren', 'tim.golden', 'ned.deily', 'lukasz.langa', 'zach.ware', 'steve.dower', 'malin', 'corona10', 'pablogsal', 's.s.mahato']
pr_nums = ['27239', '27241', '31731', '31732', '31733', '31734', '31735']
priority = 'release blocker'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue44549'
versions = ['Python 3.7', 'Python 3.8', 'Python 3.9', 'Python 3.10', 'Python 3.11']

[ssmahato]

Python (3.9.5 and 3.9.6 are using Bzip2 1.0.6 which has a known critical vulnerability.
CVE-2019-12900 (BDSA-2019-1844)
9.8 Critical NVD CVE-2016-3189 (BDSA-2019-2036).

Please upgrade the same to a stable version.

[animalize]

If you update python/cpython-source-deps, I can submit a simple PR to python/cpython.

I want to submit a PR to python/cpython-source-deps, but I think it’s better for a credible person to do this.

[corona10]

I request the dependency update to use bzip2 1.0.8 which is the stable version.

python/cpython-source-deps#25

[corona10]

@ned.deily

Is it possible to update bz2 to 1.0.8 on macOS distribution?
I found the guide to update the library on Windows but for the macOS version, I can not find.