Skip to main content

App Service Not Using Latest Programming Language Version

More Info:​

Ensure that all Microsoft Azure App Service web applications are using the latest available version of Programming Languages in order to take advantage of the latest security fixes, performance improvements, and new functionalities and features.

Risk Level​

Low

Address​

Performance, Reliability, Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS AZURE
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To remediate the issue of an App Service not using the latest programming language version in AZURE, you can follow the below steps using the AZURE console:

  1. Log in to the AZURE portal (https://portal.azure.com/).

  2. Navigate to the App Service that needs to be updated.

  3. Click on the "Configuration" option from the left-hand menu.

  4. Scroll down to the "General settings" section and locate the "Stack settings" option.

  5. Click on the "Stack settings" option and select the latest version of the programming language from the dropdown list.

  6. Click on the "Save" button to apply the changes.

  7. Restart the App Service to ensure that the changes take effect.

  8. Verify that the App Service is now using the latest version of the programming language by checking the application logs.

By following these steps, you should be able to remediate the issue of an App Service not using the latest programming language version in AZURE.

Using CLI

To remediate the issue of App Service not using the latest programming language version on Azure using Azure CLI, you can follow the below steps:

  1. Open the Azure CLI on your local machine or Azure Cloud Shell.

  2. Run the following command to set the subscription where the App Service is located:

az account set --subscription <subscription_id>
  1. Run the following command to list all the web apps in the subscription:
az webapp list --query "[].{name:name, runtimeStack:runtimeStack, stackVersion:stackVersion}" --output table

  1. Identify the web app that has the outdated programming language version and note down its name.

  2. Run the following command to update the web app's runtime stack version:

az webapp config set --name <app_name> --resource-group <resource_group_name> --linux-fx-version <runtime_stack>|<version>

Replace <app_name> with the name of the web app identified in step 4 and <resource_group_name> with the name of the resource group where the web app is located.

  1. Replace <runtime_stack> with the name of the runtime stack that you want to use (e.g., "PHP", "Python", "Node", etc.) and <version> with the latest version of the runtime stack.

  2. Run the following command to verify that the web app is now using the latest programming language version:

az webapp show --name <app_name> --resource-group <resource_group_name> --query "linuxFxVersion"

This will show the current runtime stack version of the web app.

By following these steps, you can remediate the issue of App Service not using the latest programming language version on Azure using Azure CLI.

Using Python

To remediate the issue of an App Service not using the latest programming language version for Python in Azure, you can follow these steps:

  1. Log in to the Azure portal and navigate to the App Service that is using an outdated version of Python.

  2. Click on the "Configuration" tab in the left-hand menu.

  3. Scroll down to the "General settings" section and locate the "Python version" setting.

  4. Check the current version of Python that is being used by the App Service.

  5. If the current version is outdated, select the latest version of Python from the drop-down menu.

  6. Click on the "Save" button to apply the changes.

  7. Once the changes are saved, restart the App Service to ensure that the latest version of Python is being used.

  8. To verify that the latest version of Python is being used, you can navigate to the "Advanced Tools" section in the left-hand menu and open the "Debug Console" tab.

  9. In the Debug Console, navigate to the "site" directory and open the "wwwroot" folder.

  10. Create a new file named "test.py" and add the following code:

import sys
print(sys.version)

  1. Save the file and navigate to https://your_app_service_name.azurewebsites.net/test.py in a web browser.

  2. The output should display the version of Python that is being used by the App Service. If the latest version is displayed, then the remediation process is complete.

Using Terraform
resource "azurerm_app_service" "WEB_APP" {
  name                = "WEB_APP_NAME"            # replace with your App Service name
  location            = azurerm_resource_group.RG.location
  resource_group_name = azurerm_resource_group.RG.name
  app_service_plan_id = azurerm_app_service_plan.APP_SERVICE_PLAN.id

  site_config {
    # Set ONLY the runtimes you actually use on this app.
    # Replace the placeholders below with the CURRENTLY-SUPPORTED latest versions
    # from Azure App Service runtime stack documentation.

    # For Windows / .NET:
    dotnet_version = "vLATEST_DOTNET_VERSION"      # e.g. "v8.0"

    # For Node.js:
    node_version = "LATEST_NODE_VERSION"           # e.g. "~20"

    # For PHP:
    php_version = "LATEST_PHP_VERSION"             # e.g. "8.2"

    # For Python (Windows):
    python_version = "LATEST_PYTHON_VERSION"       # e.g. "3.12"

    # For Java (Windows):
    java_version              = "LATEST_JAVA_VERSION"               # e.g. "17"
    java_container            = "JAVA_CONTAINER_NAME"               # e.g. "JAVA"
    java_container_version    = "LATEST_JAVA_CONTAINER_VERSION"     # e.g. "17"

    # Remove any language you do NOT actually use on this app;
    # leaving an unused stack enabled can still trigger the check.
  }
}

This change updates the App Service runtime stack versions in place; it does not force replacement of the App Service resource, but it will restart the app when applied (standard for site_config changes).

To verify, run terraform plan and confirm it shows only updates to site_config fields on azurerm_app_service.WEB_APP setting your chosen *_version arguments from their old values to the new latest versions, with no -/+ (destroy/create) on the App Service itself.

Additional Reading:​