Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

4/28/2020
07:30 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Continued Use of Python 2 Will Heighten Security Risks

With support for the programming language no longer available, organizations should port to Python 3, security researches say.

Nearly five months after the Python Software Foundation finally ended support for the Python 2 programming language, many developers are continuing to use it, heightening security risks for their organizations in the process.

Support for Python 2 ended Jan. 1, 2020. The Python Software Foundation has stopped making any improvement updates or security fixes for it and has urged everyone using Python 2 to move to Python 3.

The decision means that organizations using Python 2 will most likely be on their own if any major security issues — new and legacy — were to suddenly crop up in the software. Security issues that are discovered in Python 3 will not be checked against Python 2, leaving organizations vulnerable to potential attacks.

"If people find catastrophic security problems in Python 2 or in software written in Python 2, then most volunteers will not help fix them," the Python Software Foundation had bluntly noted in its Python 2 end-of-life announcement.

Python 2.0 was released in 2000 and continues to be a popular programming language among developers. Though its use has been declining in recent years, a relatively high percentage of Python apps in enterprises are based on Python 2.

In fact, as recently as June 2019 — and long after the Python Software Foundation had announced Python 2's end of life — the most popular Python packages being downloaded from the Python Package Index were still Python 2 versions.

"Even if only a portion of these downloads are being used in live projects, the Python 2 EOL could potentially affect the security of millions of systems," the UK's National Cyber Security Institute had warned in a blog last August.

A survey of 1,200 individuals conducted by ActiveState between last October and November showed 31% of organizations didn't have a plan to migrate to Python 3. Thirty-seven percent of the respondents said more than half of all Python apps in their organizations were based on Python 2. About 48% of the organizations using it were small, with less than 100 employees. But nearly one in three (29%) organizations using Python had 1,000 or more employees.

"Python 2 is used very widely in enterprise settings," says Thomas Hatch, CTO and co-founder at SaltStack, a provider of IT automation software. "It is not used to create new code nearly as often as Python 3 today, but it is still widely developed and deployed."

One reason has to do with a "if it ain't broke, don't fix it mentality," security analysts say. In many cases, organizations have been successfully using Python 2 for years without incident. It also has had very few security issues.

Since 2008, Python 2 and Python 3 together have only had 49 vulnerabilities, with 20 labeled as memory corruption, code execution, or overflows, says Shane Fry, VP of security engineering at RunSafe Security. "[That] is a super low number of CVEs compared to other popular software packages," he says.

Hatch agreed. "Python2 has been rock-solid," he says. Researchers have audited Python 2 for security issues many times over the years and haven't found a critical vulnerability in a long time. So "while it is strongly encouraged to upgrade all active code to Python3, it is not a crisis situation," Hatch says.

Code Inertia
Security stability and code inertia are not the only reasons why some organizations have been slow to port from Python 2 to Python 3. Another major reason is that many organizations are struggling to find Python 3 packages that offer the same functionality they have come to rely on from Python 2 counterparts, says Jeff Rouse, vice president of product at ActiveState.

"In addition, for large codebases, the changeover can be painstakingly long to do and requires substantial investment," Rouse says.

Other reasons that ActiveState's customers have offered for slow or delayed migration to Python 3 include challenges associated with the need to support Python 2 applications while also migrating to Python 3, learning to code in Python 3, and managing expectations, he says.

"Python 2 is proving to be a particularly difficult habit to kick," Rouse says. Until recently, many popular operating systems, including MacOS, continued to incorporate Python 2 as the default installation. Other operating systems, such as Debian and SUSE, supported both Python 2 and 3 out of the box. In fact, it wasn't until June 2017 that Python 3 users started outnumbering Python 2 users, Rouse notes.

Jonn Callahan, principal security consultant at application security provider nVisium, says even though an organization may not currently have any issues with Python 2, it still is a good idea to port to Python 3. Not updating a technology just because it works is what results in organizations accumulating insurmountable amounts of technical debt, Callahan notes.

"The truth is, applications require regular maintenance, even if nothing 'new' is being introduced," he says.

Importantly, although there is no data to support increased researcher or attacker interest in targeting Python 2, Python itself is one of the most widely used languages in the creation of both malware programs and security tools, Rouse says. So as technology advances and attacking techniques evolve, so must the code to repel them.

"A core programming language needs continual maintenance to remain secure," he notes. Importantly, using unsupported code could raise compliance issues both internally and externally with regard to mandates such as PCI DSS, ActiveState has noted.

While many organizations might have good reasons not to want to migrate to Python 3, the task of moving from Python 2 has also become much easier over the years, SaltStack's Hatch says.  

"The main issue in the past was having to wait for support libraries to move to Python 3, but this has been done with virtually all maintained Python libraries at this point," Hatch says. In addition, many tools are currently available that allow organizations to scan and upgrade large portions of Python 2 code for them, he says.

Related Content:

A listing of free products and services compiled for Dark Reading by Omdia analysts to help meet the challenges of COVID-19. 

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's featured story: "5 Ways to Prove Security's Worth in the Age of COVID-19"

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Why Vulnerable Code Is Shipped Knowingly
Chris Eng, Chief Research Officer, Veracode,  11/30/2020
Inside North Korea's Rapid Evolution to Cyber Superpower
Kelly Sheridan, Staff Editor, Dark Reading,  12/1/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-27409
PUBLISHED: 2020-12-04
OpenSIS Community Edition before 7.5 is affected by a cross-site scripting (XSS) vulnerability in SideForStudent.php via the modname parameter.
CVE-2020-27408
PUBLISHED: 2020-12-04
OpenSIS Community Edition through 7.6 is affected by incorrect access controls for the file ResetUserInfo.php that allow an unauthenticated attacker to change the password of arbitrary users.
CVE-2020-27765
PUBLISHED: 2020-12-04
A flaw was found in ImageMagick in MagickCore/segment.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. This would most likely lead to an impact to application availability, but could potentially cause ot...
CVE-2020-27766
PUBLISHED: 2020-12-04
A flaw was found in ImageMagick in MagickCore/statistic.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type `unsigned long`. This would most likely lead to an impact to application availability, b...
CVE-2020-27767
PUBLISHED: 2020-12-04
A flaw was found in ImageMagick in MagickCore/quantum.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of types `float` and `unsigned char`. This would most likely lead to an impact to application avai...