Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

07:30 PM
Connect Directly

Continued Use of Python 2 Will Heighten Security Risks

With support for the programming language no longer available, organizations should port to Python 3, security researches say.

Nearly five months after the Python Software Foundation finally ended support for the Python 2 programming language, many developers are continuing to use it, heightening security risks for their organizations in the process.

Support for Python 2 ended Jan. 1, 2020. The Python Software Foundation has stopped making any improvement updates or security fixes for it and has urged everyone using Python 2 to move to Python 3.

The decision means that organizations using Python 2 will most likely be on their own if any major security issues — new and legacy — were to suddenly crop up in the software. Security issues that are discovered in Python 3 will not be checked against Python 2, leaving organizations vulnerable to potential attacks.

"If people find catastrophic security problems in Python 2 or in software written in Python 2, then most volunteers will not help fix them," the Python Software Foundation had bluntly noted in its Python 2 end-of-life announcement.

Python 2.0 was released in 2000 and continues to be a popular programming language among developers. Though its use has been declining in recent years, a relatively high percentage of Python apps in enterprises are based on Python 2.

In fact, as recently as June 2019 — and long after the Python Software Foundation had announced Python 2's end of life — the most popular Python packages being downloaded from the Python Package Index were still Python 2 versions.

"Even if only a portion of these downloads are being used in live projects, the Python 2 EOL could potentially affect the security of millions of systems," the UK's National Cyber Security Institute had warned in a blog last August.

A survey of 1,200 individuals conducted by ActiveState between last October and November showed 31% of organizations didn't have a plan to migrate to Python 3. Thirty-seven percent of the respondents said more than half of all Python apps in their organizations were based on Python 2. About 48% of the organizations using it were small, with less than 100 employees. But nearly one in three (29%) organizations using Python had 1,000 or more employees.

"Python 2 is used very widely in enterprise settings," says Thomas Hatch, CTO and co-founder at SaltStack, a provider of IT automation software. "It is not used to create new code nearly as often as Python 3 today, but it is still widely developed and deployed."

One reason has to do with a "if it ain't broke, don't fix it mentality," security analysts say. In many cases, organizations have been successfully using Python 2 for years without incident. It also has had very few security issues.

Since 2008, Python 2 and Python 3 together have only had 49 vulnerabilities, with 20 labeled as memory corruption, code execution, or overflows, says Shane Fry, VP of security engineering at RunSafe Security. "[That] is a super low number of CVEs compared to other popular software packages," he says.

Hatch agreed. "Python2 has been rock-solid," he says. Researchers have audited Python 2 for security issues many times over the years and haven't found a critical vulnerability in a long time. So "while it is strongly encouraged to upgrade all active code to Python3, it is not a crisis situation," Hatch says.

Code Inertia
Security stability and code inertia are not the only reasons why some organizations have been slow to port from Python 2 to Python 3. Another major reason is that many organizations are struggling to find Python 3 packages that offer the same functionality they have come to rely on from Python 2 counterparts, says Jeff Rouse, vice president of product at ActiveState.

"In addition, for large codebases, the changeover can be painstakingly long to do and requires substantial investment," Rouse says.

Other reasons that ActiveState's customers have offered for slow or delayed migration to Python 3 include challenges associated with the need to support Python 2 applications while also migrating to Python 3, learning to code in Python 3, and managing expectations, he says.

"Python 2 is proving to be a particularly difficult habit to kick," Rouse says. Until recently, many popular operating systems, including MacOS, continued to incorporate Python 2 as the default installation. Other operating systems, such as Debian and SUSE, supported both Python 2 and 3 out of the box. In fact, it wasn't until June 2017 that Python 3 users started outnumbering Python 2 users, Rouse notes.

Jonn Callahan, principal security consultant at application security provider nVisium, says even though an organization may not currently have any issues with Python 2, it still is a good idea to port to Python 3. Not updating a technology just because it works is what results in organizations accumulating insurmountable amounts of technical debt, Callahan notes.

"The truth is, applications require regular maintenance, even if nothing 'new' is being introduced," he says.

Importantly, although there is no data to support increased researcher or attacker interest in targeting Python 2, Python itself is one of the most widely used languages in the creation of both malware programs and security tools, Rouse says. So as technology advances and attacking techniques evolve, so must the code to repel them.

"A core programming language needs continual maintenance to remain secure," he notes. Importantly, using unsupported code could raise compliance issues both internally and externally with regard to mandates such as PCI DSS, ActiveState has noted.

While many organizations might have good reasons not to want to migrate to Python 3, the task of moving from Python 2 has also become much easier over the years, SaltStack's Hatch says.  

"The main issue in the past was having to wait for support libraries to move to Python 3, but this has been done with virtually all maintained Python libraries at this point," Hatch says. In addition, many tools are currently available that allow organizations to scan and upgrade large portions of Python 2 code for them, he says.

Related Content:

A listing of free products and services compiled for Dark Reading by Omdia analysts to help meet the challenges of COVID-19. 

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's featured story: "5 Ways to Prove Security's Worth in the Age of COVID-19"

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/23/2020
Modern Day Insider Threat: Network Bugs That Are Stealing Your Data
David Pearson, Principal Threat Researcher,  10/21/2020
Are You One COVID-19 Test Away From a Cybersecurity Disaster?
Alan Brill, Senior Managing Director, Cyber Risk Practice, Kroll,  10/21/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-10-26
libtac in pam_tacplus through 1.5.1 lacks a check for a failure of RAND_bytes()/RAND_pseudo_bytes(). This could lead to use of a non-random/predictable session_id.
PUBLISHED: 2020-10-26
An out-of-bounds read in the JavaScript Interpreter in Facebook Hermes prior to commit 8cb935cd3b2321c46aa6b7ed8454d95c75a7fca0 allows attackers to cause a denial of service attack or possible further memory corruption via crafted JavaScript. Note that this is only exploitable if the application usi...
PUBLISHED: 2020-10-26
Ruckus through is affected by remote command injection. An authenticated user can submit a query to the API (/service/v1/createUser endpoint), injecting arbitrary commands that will be executed as root user via web.py.
PUBLISHED: 2020-10-26
Ruckus vRioT through has an API backdoor that is hardcoded into validate_token.py. An unauthenticated attacker can interact with the service API by using a backdoor value as the Authorization header.
PUBLISHED: 2020-10-26
In the git-tag-annotation-action (open source GitHub Action) before version 1.0.1, an attacker can execute arbitrary (*) shell commands if they can control the value of [the `tag` input] or manage to alter the value of [the `GITHUB_REF` environment variable]. The problem has been patched in version ...