Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

07:30 PM
Connect Directly

Continued Use of Python 2 Will Heighten Security Risks

With support for the programming language no longer available, organizations should port to Python 3, security researches say.

Nearly five months after the Python Software Foundation finally ended support for the Python 2 programming language, many developers are continuing to use it, heightening security risks for their organizations in the process.

Support for Python 2 ended Jan. 1, 2020. The Python Software Foundation has stopped making any improvement updates or security fixes for it and has urged everyone using Python 2 to move to Python 3.

The decision means that organizations using Python 2 will most likely be on their own if any major security issues — new and legacy — were to suddenly crop up in the software. Security issues that are discovered in Python 3 will not be checked against Python 2, leaving organizations vulnerable to potential attacks.

"If people find catastrophic security problems in Python 2 or in software written in Python 2, then most volunteers will not help fix them," the Python Software Foundation had bluntly noted in its Python 2 end-of-life announcement.

Python 2.0 was released in 2000 and continues to be a popular programming language among developers. Though its use has been declining in recent years, a relatively high percentage of Python apps in enterprises are based on Python 2.

In fact, as recently as June 2019 — and long after the Python Software Foundation had announced Python 2's end of life — the most popular Python packages being downloaded from the Python Package Index were still Python 2 versions.

"Even if only a portion of these downloads are being used in live projects, the Python 2 EOL could potentially affect the security of millions of systems," the UK's National Cyber Security Institute had warned in a blog last August.

A survey of 1,200 individuals conducted by ActiveState between last October and November showed 31% of organizations didn't have a plan to migrate to Python 3. Thirty-seven percent of the respondents said more than half of all Python apps in their organizations were based on Python 2. About 48% of the organizations using it were small, with less than 100 employees. But nearly one in three (29%) organizations using Python had 1,000 or more employees.

"Python 2 is used very widely in enterprise settings," says Thomas Hatch, CTO and co-founder at SaltStack, a provider of IT automation software. "It is not used to create new code nearly as often as Python 3 today, but it is still widely developed and deployed."

One reason has to do with a "if it ain't broke, don't fix it mentality," security analysts say. In many cases, organizations have been successfully using Python 2 for years without incident. It also has had very few security issues.

Since 2008, Python 2 and Python 3 together have only had 49 vulnerabilities, with 20 labeled as memory corruption, code execution, or overflows, says Shane Fry, VP of security engineering at RunSafe Security. "[That] is a super low number of CVEs compared to other popular software packages," he says.

Hatch agreed. "Python2 has been rock-solid," he says. Researchers have audited Python 2 for security issues many times over the years and haven't found a critical vulnerability in a long time. So "while it is strongly encouraged to upgrade all active code to Python3, it is not a crisis situation," Hatch says.

Code Inertia
Security stability and code inertia are not the only reasons why some organizations have been slow to port from Python 2 to Python 3. Another major reason is that many organizations are struggling to find Python 3 packages that offer the same functionality they have come to rely on from Python 2 counterparts, says Jeff Rouse, vice president of product at ActiveState.

"In addition, for large codebases, the changeover can be painstakingly long to do and requires substantial investment," Rouse says.

Other reasons that ActiveState's customers have offered for slow or delayed migration to Python 3 include challenges associated with the need to support Python 2 applications while also migrating to Python 3, learning to code in Python 3, and managing expectations, he says.

"Python 2 is proving to be a particularly difficult habit to kick," Rouse says. Until recently, many popular operating systems, including MacOS, continued to incorporate Python 2 as the default installation. Other operating systems, such as Debian and SUSE, supported both Python 2 and 3 out of the box. In fact, it wasn't until June 2017 that Python 3 users started outnumbering Python 2 users, Rouse notes.

Jonn Callahan, principal security consultant at application security provider nVisium, says even though an organization may not currently have any issues with Python 2, it still is a good idea to port to Python 3. Not updating a technology just because it works is what results in organizations accumulating insurmountable amounts of technical debt, Callahan notes.

"The truth is, applications require regular maintenance, even if nothing 'new' is being introduced," he says.

Importantly, although there is no data to support increased researcher or attacker interest in targeting Python 2, Python itself is one of the most widely used languages in the creation of both malware programs and security tools, Rouse says. So as technology advances and attacking techniques evolve, so must the code to repel them.

"A core programming language needs continual maintenance to remain secure," he notes. Importantly, using unsupported code could raise compliance issues both internally and externally with regard to mandates such as PCI DSS, ActiveState has noted.

While many organizations might have good reasons not to want to migrate to Python 3, the task of moving from Python 2 has also become much easier over the years, SaltStack's Hatch says.  

"The main issue in the past was having to wait for support libraries to move to Python 3, but this has been done with virtually all maintained Python libraries at this point," Hatch says. In addition, many tools are currently available that allow organizations to scan and upgrade large portions of Python 2 code for them, he says.

Related Content:

A listing of free products and services compiled for Dark Reading by Omdia analysts to help meet the challenges of COVID-19. 

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's featured story: "5 Ways to Prove Security's Worth in the Age of COVID-19"

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Oldest First  |  Newest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 11/19/2020
New Proposed DNS Security Features Released
Kelly Jackson Higgins, Executive Editor at Dark Reading,  11/19/2020
The Yellow Brick Road to Risk Management
Andrew Lowe, Senior Information Security Consultant, TalaTek,  11/19/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: He hits the gong anytime he sees someone click on an email link.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-11-25
osCommerce has XSS vulnerability via the authenticated user entering the XSS payload into the title section of newsletters.
PUBLISHED: 2020-11-25
GLPI stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.3, any authenticated user has read-only permissions to the planning of ever...
PUBLISHED: 2020-11-25
Nanopb is a small code-size Protocol Buffers implementation. In Nanopb before versions 0.4.4 and, decoding specifically formed message can leak memory if dynamic allocation is enabled and an oneof field contains a static submessage that contains a dynamic field, and the message being decoded...
PUBLISHED: 2020-11-25
A flaw was found in the way the spice-vdagentd daemon handled file transfers from the host system to the virtual machine. Any unprivileged local guest user with access to the UNIX domain socket path `/run/spice-vdagentd/spice-vdagent-sock` could use this flaw to perform a memory denial of service fo...
PUBLISHED: 2020-11-25
An XSS issue was found in the Shares feature of LiquidFiles before 3.3.19. The issue arises from the insecure rendering of HTML files uploaded to the platform as attachments, when the -htmlview URL is directly accessed. The impact ranges from executing commands as root on the server to retrieving se...