Assuming this history is correct, it is currently vendored at 2.7.0

Versions prior to 2.20.0 are vulnerable to this

See CVE-2018-18074

This vendored copy is not used by botocore itself any more, though some downstream libraries (such as pynamodb) are reaching into botocore's vendor directory and using it