[Bug 1887847] Re: python3.8 subinterpereters cause use-after-free in asyncio

[Mathew Hodson]

This bug was fixed in the package python3.8 - 3.8.5-1~20.04

---------------
python3.8 (3.8.5-1~20.04) focal-proposed; urgency=medium

  * SRU: LP: #1889218. Backport Python 3.8.5 to 20.04 LTS.

python3.8 (3.8.5-1) unstable; urgency=medium

  * Python 3.8.5 release.
    - Fix issue 41295, regression on __setattr__ in multiinheritance with
       metaclasses. Closes: #965069.

python3.8 (3.8.4-1) unstable; urgency=medium

  * Python 3.8.4 release.
  * Update VCS attributes in the control file.

python3.8 (3.8.4~rc1-1) unstable; urgency=medium

  * Python 3.8.4 release candidate 1.

python3.8 (3.8.3-1) unstable; urgency=medium

  * Python 3.8.3 release.
  * Add XB-Cnf-Visible-Pkgname header on the python*-minimal package to
    point command-not-found at the full one. LP: #1867157

python3.8 (3.8.3~rc1-1) unstable; urgency=medium

  * Python 3.8.3 release candidate 1.
    - Issue #38576, CVE-2019-18348: Disallow control characters in hostnames
      in http.client.
    - Issue #39503, CVE-2020-8492: Denial of service in
      urllib.request.AbstractBasicAuthHandler.

 -- Matthias Klose <doko at ubuntu.com> Tue, 28 Jul 2020 14:59:40 +0200

** Tags removed: after asyncio bpo40294 free gh-19542 gh-19565 use use-after-free
** Tags added: focal

** Also affects: python3.8 (Ubuntu Focal)
   Importance: Undecided
       Status: New

** Changed in: python3.8 (Ubuntu)
       Status: New => Fix Released

** Changed in: python3.8 (Ubuntu Focal)
   Importance: Undecided => Medium

** Tags added: bitesize

** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-18348

** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-8492

** Changed in: python3.8 (Ubuntu Focal)
       Status: New => Fix Released

-- 
You received this bug notification because you are a member of Ubuntu
Sponsors Team, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/1887847

Title:
  python3.8 subinterpereters cause use-after-free in asyncio

Status in python3.8 package in Ubuntu:
  Fix Released
Status in python3.8 source package in Focal:
  Fix Released

Bug description:
  Python 3.8.0 to 3.8.2 include a bug which breaks subinterpereters
  nearly in their entirety.

  If a subinterpereter initializes asyncio (a library used by many other
  libraries), then exits, and another subinterpereter initializes
  asyncio, there will be a use-after-free and segmentation fault.

  See: https://bugs.python.org/issue40294

  A main.c small test program is attached to that bug which replicates
  the issue.

  The bug has been fixed as of 3.8.3 and 3.9.0. I attached a patch which
  backports the one-line fix to a 3.8.2-1ubuntu1.2 version for focal.

  I am writing a piece of software that I fear will be unusable on focal
  without this backport, since the default python3 is python
  3.8.2-1ubuntu1.1 at the time of writing. Since it does not contain the
  fix, my application crashes.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/python3.8/+bug/1887847/+subscriptions