Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

10/31/2019
04:45 PM
50%
50%

Slow Retreat from Python 2 Threatens Code Security

The end of life is near for Python 2, and there will be no rising from the grave this time. So why are some companies and developers risking a lack of security patches to stay with the old version of the programming language?

At least one in 10 Python developers and data scientists continue to use the legacy version of the popular programming language as their primary development tool, despite a looming deadline of Jan. 1, 2020, the official "end of life" for Python 2.

The death of the programming language means companies that continue to use the technology — often to support legacy programs — will be at risk, experts say. While vulnerabilities in the core methods of the programming language are uncommon, many Python 2 packages will also be left with no — or dramatically less — support, likely leaving legacy programs unpatched.

The result is that maintainers will no longer step in to fix even serious vulnerabilities, says Jeff Rouse, vice president of product at ActiveState, a software tools maker. 

"The primary security risk is that vulnerabilities will arise and then there is not a core team to get those things fixed in a timely fashion," he says. "And that is not just talking about code language, but the package and ecosystem as well."

As the clock counts down on Python 2, some security professionals have warned that companies that fail to move from the older version of the programming language will put their software in the crosshairs of hackers when a vulnerability is found. As of May, 13% of Python programmers still used version 2 as their primary development language. While still high, that share is half of the 25% who were using the language at the end of 2017, according to JetBrains, a market research firm.

In August, the UK's watchdog for cybersecurity concerns, the National Cyber Security Centre, warned Python programmers that they should move to the latest version of Python.

"[I]f you're still using 2.x, it's time to port your code to Python 3," the NCSC wrote. "If you continue to use unsupported modules, you are risking the security of your organisation and data, as vulnerabilities will sooner or later appear which nobody is fixing."

The Python Software Foundation has made it clear that Python 2 users will find themselves without patches starting in January.

"If people find catastrophic security problems in Python 2, or in software written in Python 2, then most volunteers will not help fix them," the group wrote in an alert on the sunsetting of Python 2.

The move from Python 2 has been more than a decade in the works. The Python Software Foundation released Python 2 in 2000 and, realizing there were many improvements the core maintainers could add to the programming language, released Python 3 in 2006. Yet developers did not move from Python 2, so a couple of years later, the Python Software Foundation announced its volunteers would stop supporting the previous major version of its increasingly popular programming language, beginning in 2015. 

Developers very slowly — half were still using Python 3 in 2013 — started moving from Python 2, but too many remained. The year before the deadline, the project leadership recognized that programmers were not cooperating, so they pushed back the deadline to Jan. 1, 2020.

Now it's time, the group said. Python 2 has been sapping too many resources for too long, the group chastised.

"If you need help with Python 2 software, then many volunteers will not help you, and over time fewer and fewer volunteers will be able to help you," the group said in a blog post. "You will lose chances to use good tools because they will only run on Python 3, and you will slow down people who depend on you and work with you."

The main problem for companies is that Python 3 is not backward-compatible with Python 2. Too many changes were made to the language. Because of those issues, it took Dropbox — a company whose services run widely on Python and that had employed the creator of Python until he retired this month — three years to convert all of its software and infrastructure from Python 2.

"Python 3 adoption has long been a subject of debate in the Python community," Dropbox  said in 2018. "This is still somewhat true, though it's now reached widespread support, with some very popular projects such as Django dropping Python 2 support entirely."

The number of packages downloaded for Python 2 continues to be in the millions per month, with almost two-thirds of downloads for the URL resource module urllib and half of the downloads of Web library requests continuing to be for Python 2.

It does not help that Python 2.7 continues to be the default version installed on Mac OS X, even on Catalina, the latest version of Apple's operating system. Other operating systems have fallen into line, however. In 2018, Ubuntu upgraded to Python 3.6 as the default in 18.04 LTS, also known as Bionic Beaver, and Red Hat dropped support for Python 2 in Red Hat Enterprise Linux 8. Python does not ship by default with Windows.

In addition, many major open source libraries have committed to dropping Python 2 in favor of Python 3 by 2020.

For companies that will not make the deadline, some software firms, such as ActiveState, are offering to extend support for security patches for Python 2.

"It is amazing that even with the amount of notice that the core team and [the Python Software Foundation] has given that enterprises have very large codebases, and they don't have the time or inclination to get off those applications when they still provide value to them," Rouse says. "Some of them are migrating but have not gotten around to it yet, while others don't plan to migrate, but they want someone to have their back. It is a situation where a lot of companies knew it was coming."

Related Content

This free, all-day online conference offers a look at the latest tools, strategies, and best practices for protecting your organization’s most sensitive data. Click for more information and, to register, here.

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/6/2020
Introducing 'Secure Access Service Edge'
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  7/3/2020
Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5604
PUBLISHED: 2020-07-09
Android App 'Mercari' (Japan version) prior to version 3.52.0 allows arbitrary method execution of a Java object by a remoto attacker via a Man-In-The-Middle attack by using Java Reflection API of JavaScript code on WebView.
CVE-2020-5974
PUBLISHED: 2020-07-08
NVIDIA JetPack SDK, version 4.2 and 4.3, contains a vulnerability in its installation scripts in which permissions are incorrectly set on certain directories, which can lead to escalation of privileges.
CVE-2020-15072
PUBLISHED: 2020-07-08
An issue was discovered in phpList through 3.5.4. An error-based SQL Injection vulnerability exists via the Import Administrators section.
CVE-2020-15073
PUBLISHED: 2020-07-08
An issue was discovered in phpList through 3.5.4. An XSS vulnerability occurs within the Import Administrators section via upload of an edited text document. This also affects the Subscriber Lists section.
CVE-2020-2034
PUBLISHED: 2020-07-08
An OS Command Injection vulnerability in the PAN-OS GlobalProtect portal allows an unauthenticated network based attacker to execute arbitrary OS commands with root privileges. An attacker requires some knowledge of the firewall to exploit this issue. This issue can not be exploited if GlobalProtect...