Backport CVE-2023-24329 to all in-service releases: urlparse does not correctly handle schemes that begin with ASCII digits, '+', '-', and '.' characters

[RSAlderman]

Feature or enhancement

Backport CVE-2023-24329 (CVSS 7.5: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) to all in-service releases: urlparse does not correctly handle schemes that begin with ASCII digits, '+', '-', and '.' characters which was backported to 3.11.1 only

Pitch

This is a security vulnerability that has only been backported to 3.11.1, not the other releases (3.7-3.10) that are currently supported.

Previous discussion

Is it possible to get an idea of a timescale for such as backport to be implemented in the earlier supported releases?

[gpshead]

I'm closing this as a duplicate of #102153 as it isn't clear that all of this was even fixed. We'll make any decision on what to backport it to there.