Turns out that naming matters and when Imperva named this bug "Node2Shell" they did us a disservice. This bug affects Python via two packges: brotli and brotlicffi. All versions are vulnerable except the latest.