merge 3.3 (#19435)

diff --cc Lib/http/server.py
Simple merge

diff --cc Lib/test/test_httpservers.py
Simple merge

diff --cc Misc/NEWS
index ab0893fd1cd78d7266bdf3a2cbd55eb15845c5b3,5bcf60d6e7078d24a1e63ff9fc1bc40ee83f0029..a76afbe87881cb5865fb6dd7c1637672e94f596c
--- 1/Misc/NEWS
--- 2/Misc/NEWS
+++ b/Misc/NEWS
@@@ -25,22 -27,75 +25,24 @@@ Core and Builtin
  - Issue #18603: Ensure that PyOS_mystricmp and PyOS_mystrnicmp are in the
    Python executable and not removed by the linker's optimizer.
  
 -- Issue #19279: UTF-7 decoder no more produces illegal strings.
 -
 -- Fix macro expansion of _PyErr_OCCURRED(), and make sure to use it in at
 -  least one place so as to avoid regressions.
 -
 -- Issue #19014: memoryview.cast() is now allowed on zero-length views.
 -
 -- Issue #19098: Prevent overflow in the compiler when the recursion limit is set
 -  absurdly high.
 -
 -- Issue #18942: sys._debugmallocstats() output was damaged on Windows.
 -
 -- Issue #18667: Add missing "HAVE_FCHOWNAT" symbol to posix._have_functions.
 -
 -- Issue #18368: PyOS_StdioReadline() no longer leaks memory when realloc()
 -  fails.
 -
 -- Issue #16741: Fix an error reporting in int().
 -
 -- Issue #17899: Fix rare file descriptor leak in os.listdir().
 -
 -- Issue #18552: Check return value of PyArena_AddPyObject() in
 -  obj2ast_object().
 -
 -- Issue #18560: Fix potential NULL pointer dereference in sum().
 -
 -- Issue #15905: Fix theoretical buffer overflow in handling of sys.argv[0],
 -  prefix and exec_prefix if the operation system does not obey MAXPATHLEN.
 -
 -- Issue #18344: Fix potential ref-leaks in _bufferedreader_read_all().
 -
 -- Issue #17872: Fix a segfault in marshal.load() when input stream returns
 -  more bytes than requested.
 -
 -- Issue #18426: Fix NULL pointer dereference in C extension import when
 -  PyModule_GetDef() returns an error.
 -
 -- Issue #18328: Reorder ops in PyThreadState_Delete*() functions. Now the
 -  tstate is first removed from TLS and then deallocated.
 -
 -- Issue #18184: PyUnicode_FromFormat() and PyUnicode_FromFormatV() now raise
 -  OverflowError when an argument of %c format is out of range.
 -
 -- Issue #18137: Detect integer overflow on precision in float.__format__()
 -  and complex.__format__().
 -
 -- Issue #18183: Fix various unicode operations on strings with large unicode
 -  codepoints.
 +- Issue #19306: Add extra hints to the faulthandler module's stack
 +  dumps that these are "upside down".
  
 -- Issue #18180: Fix ref leak in _PyImport_GetDynLoadWindows().
 -
 -- Issue #18038: SyntaxError raised during compilation sources with illegal
 -  encoding now always contains an encoding name.
 +Library
 +-------
  
 -- Issue #17644: Fix a crash in str.format when curly braces are used in square
 -  brackets.
 +- Issue #19424: Fix the warnings module to accept filename containing surrogate
 +  characters.
  
 -- Issue #17983: Raise a SyntaxError for a ``global __class__`` statement in a
 -  class body.
++- Issue #19435: Fix directory traversal attack on CGIHttpRequestHandler.
+ 
 -- Issue #17927: Frame objects kept arguments alive if they had been copied into
 -  a cell, even if the cell was cleared.
 +- Issue #19227: Remove pthread_atfork() handler. The handler was added to
 +  solve #18747 but has caused issues.
  
 -Library
 --------
 +- Issue #19420: Fix reference leak in module initalization code of
 +  _hashopenssl.c
  
 -- Issue #19395: Raise an exception when attempting to pickle a bz2 or lzma
 -  compressor/decompressor object, rather than creating a pickle that would
 -  cause a segfault when loaded and used.
 +- Issue #19329: Optimized compiling charsets in regular expressions.
  
  - Issue #19227: Try to fix deadlocks caused by re-seeding then OpenSSL
    pseudo-random number generator on fork().