Older versions are typically supported for security updates within 2 years of release. As of writing this Policy, that is:

You can report a vulnerability privately to the author at python@figsandfudge.com. You should expect an acknowledgement within a 1 week which will include an indication of when vulnerability will be analysed and fixed.