But does the sqlite3 module actually contain SQLite with it, or just a library to interface with it? The fix does not change any interface library code.

Does python use it's own sqlite3 or system sqlite3? In the latter case, patches would be the package maintainers' responsibility.

Of course, on Windows, it's going to have to use its own sqlite3.

> Does this mean Python needs to ship a security path?

Python binaries (e.g. the Windows installers) may need to be updated. For Linux distros Python would depend on a system package.

It's only an issue if you allow untrusted code to run arbitrary SQL statements, which should never be done.