Skip to main content

πŸ“ Azure App Service does not run the latest Python version 🟒

  • Contextual name: πŸ“ App Service does not run the latest Python version 🟒
  • ID: /ce/ca/azure/app-service/latest-python-version
  • Located in: πŸ“ Azure App Service

Flags​

Our Metadata​

  • Policy Type: COMPLIANCE_POLICY
  • Policy Category:
    • SECURITY
    • RELIABILITY
    • PERFORMANCE

Similar Policies​

Similar Internal Rules​

RulePoliciesFlags
βœ‰οΈ dec-x-a20e54a01

Description​

Open File

Description​

Periodically, older versions of Python may be deprecated and no longer supported. Using a supported version of Python for app services is recommended to avoid potential unpatched vulnerabilities.

Rationale​

Deprecated and unsupported versions of programming and scripting languages can present vulnerabilities which may not be addressed or may not be addressable.

Impact​

If your app is written using version-dependent features or libraries, they may not be available on more recent versions. If you wish to update, research the impact thoroughly.

Audit​

Take note of the currently supported versions (given a status of "security") of Python here: https://devguide.python.org/versions/

From Azure Portal​
  1. From Azure Home open the Portal Menu in the top left.
  2. Go to App Services.
  3. Click on each App.
  4. Under Settings section, click on Configuration.
  5. Click on the General settings pane, ensure that for a Stack of Python the Major Version and Minor Version reflect a currently supported release.

... see more

Remediation​

Open File

Remediation​

From Azure Portal​

  1. From Azure Home open the Portal Menu in the top left.
  2. Go to App Services.
  3. Click on each App.
  4. Under Settings section, click on Configuration.
  5. Click on the General settings pane and ensure that the Major Version and the Minor Version is set to a currently supported release.

NOTE: No action is required if Python version is set to Off, as Python is not used by your web app.

From Azure CLI​

To see the list of supported runtimes:

az webapp list-runtimes

To set latest Python version for an existing app, run the following command:

az webapp config set --resource-group <RESOURCE_GROUP_NAME> --name <APP_NAME> --windows-fx-version "PYTHON|<VERSION>" --linux-fx-version "PYTHON|<VERSION>"

From PowerShell​

As of this writing, there is no way to update an existing application's SiteConfig or set the a new application's SiteConfig settings during creation via PowerShell.

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlags
πŸ’Ό APRA CPG 234 β†’ πŸ’Ό 36h patch management controls β€” to manage the assessment and application of patches and other updates that address known vulnerabilities in a timely manner;66
πŸ’Ό APRA CPG 234 β†’ πŸ’Ό 40 An important aspect of information asset life-cycle management involves minimising vulnerabilities and maintaining support. Information security exposures could arise from hardware and software which is outdated or has limited or no support (whether through a third party, a related party or in-house). Technology that is end-of-life5 , out-of-support or in extended support is typically less secure by design, has a dated security model and can take longer, or is unable, to be updated to address new threats.66
πŸ’Ό CIS Azure v1.1.0 β†’ πŸ’Ό 9.8 Ensure that 'Python version' is the latest, if used to run the web app11
πŸ’Ό CIS Azure v1.3.0 β†’ πŸ’Ό 9.7 Ensure that 'Python version' is the latest, if used to run the web app - Level 1 (Manual)11
πŸ’Ό CIS Azure v1.5.0 β†’ πŸ’Ό 9.7 Ensure that 'Python version' is the Latest Stable Version, if Used to Run the Web App - Level 1 (Manual)11
πŸ’Ό CIS Azure v2.0.0 β†’ πŸ’Ό 9.7 Ensure that 'Python version' is the Latest Stable Version, if Used to Run the Web App - Level 1 (Manual)11
πŸ’Ό CIS Azure v2.1.0 β†’ πŸ’Ό 9.6 Ensure that 'Python version' is the Latest Stable Version, if Used to Run the Web App - Level 1 (Manual)11
πŸ’Ό CIS Azure v3.0.0 β†’ πŸ’Ό 9.8 Ensure that 'Python version' is currently supported (if in use) (Manual)1
πŸ’Ό Cloudaware Framework β†’ πŸ’Ό Infrastructure Modernization12
πŸ’Ό FedRAMP High Security Controls β†’ πŸ’Ό CM-5 Access Restrictions for Change (L)(M)(H)21416
πŸ’Ό FedRAMP High Security Controls β†’ πŸ’Ό CM-7 Least Functionality (L)(M)(H)31833
πŸ’Ό FedRAMP High Security Controls β†’ πŸ’Ό CM-11 User-installed Software (L)(M)(H)44
πŸ’Ό FedRAMP Low Security Controls β†’ πŸ’Ό CM-5 Access Restrictions for Change (L)(M)(H)8
πŸ’Ό FedRAMP Low Security Controls β†’ πŸ’Ό CM-7 Least Functionality (L)(M)(H)29
πŸ’Ό FedRAMP Low Security Controls β†’ πŸ’Ό CM-11 User-installed Software (L)(M)(H)4
πŸ’Ό FedRAMP Moderate Security Controls β†’ πŸ’Ό CM-5 Access Restrictions for Change (L)(M)(H)216
πŸ’Ό FedRAMP Moderate Security Controls β†’ πŸ’Ό CM-7 Least Functionality (L)(M)(H)333
πŸ’Ό FedRAMP Moderate Security Controls β†’ πŸ’Ό CM-11 User-installed Software (L)(M)(H)4
πŸ’Ό ISO/IEC 27001:2013 β†’ πŸ’Ό A.12.5.1 Installation of software on operational systems55
πŸ’Ό NIST CSF v1.1 β†’ πŸ’Ό DE.CM-3: Personnel activity is monitored to detect potential cybersecurity events2026
πŸ’Ό NIST CSF v1.1 β†’ πŸ’Ό DE.CM-5: Unauthorized mobile code is detected1111
πŸ’Ό NIST CSF v1.1 β†’ πŸ’Ό ID.AM-2: Software platforms and applications within the organization are inventoried57
πŸ’Ό NIST CSF v1.1 β†’ πŸ’Ό PR.DS-6: Integrity checking mechanisms are used to verify software, firmware, and information integrity2226
πŸ’Ό NIST CSF v1.1 β†’ πŸ’Ό PR.IP-1: A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality)426
πŸ’Ό NIST CSF v1.1 β†’ πŸ’Ό PR.IP-3: Configuration change control processes are in place55
πŸ’Ό NIST CSF v1.1 β†’ πŸ’Ό PR.PT-3: The principle of least functionality is incorporated by configuring systems to provide only essential capabilities2130
πŸ’Ό NIST CSF v2.0 β†’ πŸ’Ό DE.CM-01: Networks and network services are monitored to find potentially adverse events115
πŸ’Ό NIST CSF v2.0 β†’ πŸ’Ό DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events81
πŸ’Ό NIST CSF v2.0 β†’ πŸ’Ό DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events134
πŸ’Ό NIST CSF v2.0 β†’ πŸ’Ό ID.AM-02: Inventories of software, services, and systems managed by the organization are maintained9
πŸ’Ό NIST CSF v2.0 β†’ πŸ’Ό ID.RA-07: Changes and exceptions are managed, assessed for risk impact, recorded, and tracked28
πŸ’Ό NIST CSF v2.0 β†’ πŸ’Ό PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected114
πŸ’Ό NIST SP 800-53 Revision 5 β†’ πŸ’Ό SI-2(6) Flaw Remediation _ Removal of Previous Versions of Software and Firmware66
πŸ’Ό NIST SP 800-53 Revision 5 β†’ πŸ’Ό SI-7(12) Software, Firmware, and Information Integrity _ Integrity Verification1921
πŸ’Ό UK Cyber Essentials β†’ πŸ’Ό 3.1 All software on in-scope devices must be licensed and supported66