Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

04:45 PM

Slow Retreat from Python 2 Threatens Code Security

The end of life is near for Python 2, and there will be no rising from the grave this time. So why are some companies and developers risking a lack of security patches to stay with the old version of the programming language?

At least one in 10 Python developers and data scientists continue to use the legacy version of the popular programming language as their primary development tool, despite a looming deadline of Jan. 1, 2020, the official "end of life" for Python 2.

The death of the programming language means companies that continue to use the technology — often to support legacy programs — will be at risk, experts say. While vulnerabilities in the core methods of the programming language are uncommon, many Python 2 packages will also be left with no — or dramatically less — support, likely leaving legacy programs unpatched.

The result is that maintainers will no longer step in to fix even serious vulnerabilities, says Jeff Rouse, vice president of product at ActiveState, a software tools maker. 

"The primary security risk is that vulnerabilities will arise and then there is not a core team to get those things fixed in a timely fashion," he says. "And that is not just talking about code language, but the package and ecosystem as well."

As the clock counts down on Python 2, some security professionals have warned that companies that fail to move from the older version of the programming language will put their software in the crosshairs of hackers when a vulnerability is found. As of May, 13% of Python programmers still used version 2 as their primary development language. While still high, that share is half of the 25% who were using the language at the end of 2017, according to JetBrains, a market research firm.

In August, the UK's watchdog for cybersecurity concerns, the National Cyber Security Centre, warned Python programmers that they should move to the latest version of Python.

"[I]f you're still using 2.x, it's time to port your code to Python 3," the NCSC wrote. "If you continue to use unsupported modules, you are risking the security of your organisation and data, as vulnerabilities will sooner or later appear which nobody is fixing."

The Python Software Foundation has made it clear that Python 2 users will find themselves without patches starting in January.

"If people find catastrophic security problems in Python 2, or in software written in Python 2, then most volunteers will not help fix them," the group wrote in an alert on the sunsetting of Python 2.

The move from Python 2 has been more than a decade in the works. The Python Software Foundation released Python 2 in 2000 and, realizing there were many improvements the core maintainers could add to the programming language, released Python 3 in 2006. Yet developers did not move from Python 2, so a couple of years later, the Python Software Foundation announced its volunteers would stop supporting the previous major version of its increasingly popular programming language, beginning in 2015. 

Developers very slowly — half were still using Python 3 in 2013 — started moving from Python 2, but too many remained. The year before the deadline, the project leadership recognized that programmers were not cooperating, so they pushed back the deadline to Jan. 1, 2020.

Now it's time, the group said. Python 2 has been sapping too many resources for too long, the group chastised.

"If you need help with Python 2 software, then many volunteers will not help you, and over time fewer and fewer volunteers will be able to help you," the group said in a blog post. "You will lose chances to use good tools because they will only run on Python 3, and you will slow down people who depend on you and work with you."

The main problem for companies is that Python 3 is not backward-compatible with Python 2. Too many changes were made to the language. Because of those issues, it took Dropbox — a company whose services run widely on Python and that had employed the creator of Python until he retired this month — three years to convert all of its software and infrastructure from Python 2.

"Python 3 adoption has long been a subject of debate in the Python community," Dropbox  said in 2018. "This is still somewhat true, though it's now reached widespread support, with some very popular projects such as Django dropping Python 2 support entirely."

The number of packages downloaded for Python 2 continues to be in the millions per month, with almost two-thirds of downloads for the URL resource module urllib and half of the downloads of Web library requests continuing to be for Python 2.

It does not help that Python 2.7 continues to be the default version installed on Mac OS X, even on Catalina, the latest version of Apple's operating system. Other operating systems have fallen into line, however. In 2018, Ubuntu upgraded to Python 3.6 as the default in 18.04 LTS, also known as Bionic Beaver, and Red Hat dropped support for Python 2 in Red Hat Enterprise Linux 8. Python does not ship by default with Windows.

In addition, many major open source libraries have committed to dropping Python 2 in favor of Python 3 by 2020.

For companies that will not make the deadline, some software firms, such as ActiveState, are offering to extend support for security patches for Python 2.

"It is amazing that even with the amount of notice that the core team and [the Python Software Foundation] has given that enterprises have very large codebases, and they don't have the time or inclination to get off those applications when they still provide value to them," Rouse says. "Some of them are migrating but have not gotten around to it yet, while others don't plan to migrate, but they want someone to have their back. It is a situation where a lot of companies knew it was coming."

Related Content

This free, all-day online conference offers a look at the latest tools, strategies, and best practices for protecting your organization’s most sensitive data. Click for more information and, to register, here.

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Microsoft to Officially End Support for Windows 7, Server 2008
Kelly Sheridan, Staff Editor, Dark Reading,  1/13/2020
Active Directory Needs an Update: Here's Why
Raz Rafaeli, CEO and Co-Founder at Secret Double Octopus,  1/16/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-01-17
Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not incl...
PUBLISHED: 2020-01-17
Eclipse Memory Analyzer version 1.9.1 and earlier is subject to a deserialization vulnerability if an index file of a parsed heap dump is replaced by a malicious version and the heap dump is reopened in Memory Analyzer. The user must chose to reopen an already parsed heap dump with an untrusted inde...
PUBLISHED: 2020-01-17
It was found that the Red Hat Enterprise Linux 8 kpatch update did not include the complete fix for CVE-2018-12207. A flaw was found in the way Intel CPUs handle inconsistency between, virtual to physical memory address translations in CPU's local cache and system software's Paging structure entries...
PUBLISHED: 2020-01-17
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2008-1382. Reason: This candidate is a reservation duplicate of CVE-2008-1382. Notes: All CVE users should reference CVE-2008-1382 instead of this candidate. All references and descriptions in this candidate have been removed to prevent ...
PUBLISHED: 2020-01-17
Eclipse Memory Analyzer version 1.9.1 and earlier is subject to a cross site scripting (XSS) vulnerability when generating an HTML report from a malicious heap dump. The user must chose todownload, open the malicious heap dump and generate an HTML report for the problem to occur. The heap dump could...