Skip to main content

🛡️ Azure App Service does not run the latest Java version🟢⚪

  • Contextual name: 🛡️ App Service does not run the latest Java version🟢⚪
  • ID: /ce/ca/azure/app-service/latest-java-version
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: SECURITY, RELIABILITY, PERFORMANCE

Similar Policies​

Similar Internal Rules​

RulePoliciesFlags
✉️ dec-x-879aa9961

Description​

Open File

Description​

Periodically, older versions of Java may be deprecated and no longer supported. Using a supported version of Java for App Services is recommended to avoid potential unpatched vulnerabilities.

Rationale​

Deprecated and unsupported versions of programming and scripting languages can present vulnerabilities that may not be addressed or may not be addressable.

Impact​

If your app is written using version-dependent features or libraries, they may not be available on more recent versions. If you wish to update, research the impact thoroughly.

Audit​

Take note of the currently supported Java versions here: https://www.oracle.com/java/technologies/java-se-support-roadmap.html

From Azure Portal​
  1. Log in to the Azure portal using https://portal.azure.com.
  2. Go to App Services.
  3. Select each app.
  4. Under Settings section, click on Configuration.
  5. Select the General settings pane and ensure that for a Stack of Java, the Major Version and Minor Version reflect a currently supported release, and that the Java web server version is set to the auto-update option.

... see more

Remediation​

Open File

Remediation​

From Azure Portal​

  1. Log in to the Azure portal using https://portal.azure.com.
  2. Go to App Services.
  3. Select each app.
  4. Under Settings section, click on Configuration.
  5. Select the General settings pane and ensure that for a Stack of Java, the Major Version and Minor Version reflect a currently supported release, and that the Java web server version is set to the auto-update option.

Note: No action is required if Java version is set to Off, as Java is not used by your web app.

From Azure CLI​

To see the list of supported runtimes:

az webapp list-runtimes

To set a currently supported Java version for an existing app, run the following command:

az webapp config set \
    --resource-group {{resource-group-name}} \
    --name {{app-name}} \
    --java-version {{java-version}} \
    --java-container {{java-container}} \
    --java-container-version {{java-container-version}} \
    --windows-fx-version {{java-runtime-version}} \
    --linux-fx-version {{java-runtime-version}}

... [see more](remediation.md)

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 APRA CPG 234 → 💼 36h patch management controls — to manage the assessment and application of patches and other updates that address known vulnerabilities in a timely manner;77no data
💼 APRA CPG 234 → 💼 40 An important aspect of information asset life-cycle management involves minimising vulnerabilities and maintaining support. Information security exposures could arise from hardware and software which is outdated or has limited or no support (whether through a third party, a related party or in-house). Technology that is end-of-life5 , out-of-support or in extended support is typically less secure by design, has a dated security model and can take longer, or is unable, to be updated to address new threats.77no data
💼 CIS Azure v1.1.0 → 💼 9.9 Ensure that 'Java version' is the latest, if used to run the web app11no data
💼 CIS Azure v1.3.0 → 💼 9.8 Ensure that 'Java version' is the latest, if used to run the web app - Level 1 (Manual)11no data
💼 CIS Azure v1.4.0 → 💼 9.8 Ensure that 'Java version' is the latest, if used to run the Web App - Level 1 (Manual)11no data
💼 CIS Azure v1.5.0 → 💼 9.8 Ensure that 'Java version' is the latest, if used to run the Web App - Level 1 (Manual)11no data
💼 CIS Azure v2.0.0 → 💼 9.8 Ensure that 'Java version' is the latest, if used to run the Web App - Level 1 (Manual)11no data
💼 CIS Azure v2.1.0 → 💼 9.7 Ensure that 'Java version' is the latest, if used to run the Web App - Level 1 (Manual)11no data
💼 CIS Azure v3.0.0 → 💼 9.9 Ensure that 'Java version' is currently supported (if in use) (Manual)1no data
💼 Cloudaware Framework → 💼 Infrastructure Modernization21no data
💼 FedRAMP High Security Controls → 💼 CM-5 Access Restrictions for Change (L)(M)(H)21416no data
💼 FedRAMP High Security Controls → 💼 CM-7 Least Functionality (L)(M)(H)31833no data
💼 FedRAMP High Security Controls → 💼 CM-11 User-installed Software (L)(M)(H)44no data
💼 FedRAMP Low Security Controls → 💼 CM-5 Access Restrictions for Change (L)(M)(H)8no data
💼 FedRAMP Low Security Controls → 💼 CM-7 Least Functionality (L)(M)(H)29no data
💼 FedRAMP Low Security Controls → 💼 CM-11 User-installed Software (L)(M)(H)4no data
💼 FedRAMP Moderate Security Controls → 💼 CM-5 Access Restrictions for Change (L)(M)(H)216no data
💼 FedRAMP Moderate Security Controls → 💼 CM-7 Least Functionality (L)(M)(H)333no data
💼 FedRAMP Moderate Security Controls → 💼 CM-11 User-installed Software (L)(M)(H)4no data
💼 ISO/IEC 27001:2013 → 💼 A.12.5.1 Installation of software on operational systems55no data
💼 NIST CSF v1.1 → 💼 DE.CM-3: Personnel activity is monitored to detect potential cybersecurity events2026no data
💼 NIST CSF v1.1 → 💼 DE.CM-5: Unauthorized mobile code is detected1112no data
💼 NIST CSF v1.1 → 💼 ID.AM-2: Software platforms and applications within the organization are inventoried57no data
💼 NIST CSF v1.1 → 💼 PR.DS-6: Integrity checking mechanisms are used to verify software, firmware, and information integrity2227no data
💼 NIST CSF v1.1 → 💼 PR.IP-1: A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality)426no data
💼 NIST CSF v1.1 → 💼 PR.IP-3: Configuration change control processes are in place55no data
💼 NIST CSF v1.1 → 💼 PR.PT-3: The principle of least functionality is incorporated by configuring systems to provide only essential capabilities2130no data
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events180no data
💼 NIST CSF v2.0 → 💼 DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events100no data
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events181no data
💼 NIST CSF v2.0 → 💼 ID.AM-02: Inventories of software, services, and systems managed by the organization are maintained9no data
💼 NIST CSF v2.0 → 💼 ID.RA-07: Changes and exceptions are managed, assessed for risk impact, recorded, and tracked49no data
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected187no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-2(6) Flaw Remediation _ Removal of Previous Versions of Software and Firmware66no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-7(12) Software, Firmware, and Information Integrity _ Integrity Verification1921no data
💼 UK Cyber Essentials → 💼 3.1 All software on in-scope devices must be licensed and supported66no data