Microsoft AzureOverview
Older versions of Java may periodically be deprecated and no longer supported. To avoid potential unpatched vulnerabilities, it is recommended that you use a supported version of Java for app services.
Rationale
Deprecated and unsupported versions of programming and scripting languages can present vulnerabilities that are either unaddressable or not addressable.
Impact
If your app is written using version-dependent features or libraries, they may not be available on more recent versions. If you wish to update, research the impact thoroughly.
Default Value
You select the value when creating the web app.
Remediation guidance
Remediate from Azure Portal
- Open the app using the
Open in Azurebutton. - Under
Settingssection, click onConfiguration - Click on the
General settingspane and ensure that for aStackofJavatheMajor VersionandMinor Versionreflect a currently supported release, and that theJava web server versionis set to theauto-updateoption.
Remediate from Azure CLI
To see the list of supported runtimes:
az webapp list-runtimes
To set a currently supported Java version for an existing app, run the following command:
az webapp config set --resource-group --name [--java-version --java-container --java-container-version [--windows-fx-version ] [--linux-fx-version ]
Service-wide remediation
Recommended when many resources are affected: fix the platform baseline first so new resources inherit the secure setting, then remediate the existing flagged resources in batches.
Azure
Use management group or subscription Azure Policy assignments, remediation tasks where supported, landing-zone standards, and IaC modules so drift is prevented at scale.
Operational rollout
- Fix the baseline first at the account, subscription, project, cluster, or tenant scope that owns this control.
- Remediate the currently affected resources in batches, starting with internet-exposed and production assets.
- Re-scan and track approved exceptions with an owner and expiry date.
Query logic
These are the stored checks tied to this control.
Azure app services running unsupported Java versions
Connectors
Covered asset types
Expected check: eq []
{
sites(
where: { siteConfig: { NOT: { javaVersion: "" }, isDeprecated: true } }
) {
...AssetFragment
}
}
