[3.7] bpo-41304: Update NEWS to include CVE-2020-15801 reference (GH-21521) by miss-islington · Pull Request #21524 · python/cpython

the-knights-who-say-ni

@ned-deily The NEWS update you requested.

Make sure when you merge you update the commit to [bpo-41304](https://bugs.python.org/issue41304): Update NEWS to include CVE-2020-15801 reference (GH-21521) - otherwise it'll merge with the wrong bpo number.

(Edit it without the Markdown link that keeps being inserted about the bpo number)