merge 3.4 (#21766)

diff --cc Misc/NEWS
index 76502f3943ec1a592b4e90fa90a9631db83cff44,66d9132c7b837504eae1118e902ac9a9e38f3cab..dbd16e55ca2e929fc97e9f75f1ea0df381a97cf1
--- 1/Misc/NEWS
--- 2/Misc/NEWS
+++ b/Misc/NEWS
@@@ -106,11 -26,11 +106,14 @@@ Librar
    run_forever() and run_until_complete() methods of asyncio.BaseEventLoop now
    raise an exception if the event loop was closed.
  
+ - Issue #21766: Prevent a security hole in CGIHTTPServer by URL unquoting paths
+   before checking for a CGI script at that path.
+ 
  - Issue #21310: Fixed possible resource leak in failed open().
  
 +- Issue #21256: Printout of keyword args should be in deterministic order in
 +  a mock function call. This will help to write better doctests.
 +
  - Issue #21677: Fixed chaining nonnormalized exceptions in io close() methods.
  
  - Issue #11709: Fix the pydoc.help function to not fail when sys.stdin is not a