Check ID: app_ensure_python_version_is_latest
Provider: Azure
Service: app
Severity: LOW
Categories: vulnerabilities
Resource type: microsoft.web/sites

What this check verifies

Azure App Service web apps using Python are assessed to confirm the runtime is the latest supported version (e.g., 3.12). The evaluation reads the app’s stack configuration to detect Python usage and compares the configured runtime against the defined latest baseline.

Risk

Outdated Python runtimes weaken security and reliability:
  • Compromise confidentiality via known interpreter/SSL flaws
  • Undermine integrity through RCE and package exploitation
  • Reduce availability when deprecated versions lose patches and break under load

Recommendation

Adopt the latest supported Python minor for App Service and maintain a consistent upgrade policy. Track vendor EOL, test in staging, and roll out via CI/CD. Apply defense in depth: minimize privileges and enforce strong TLS to reduce exposure during updates.

Remediation

az webapp config set —resource-group <RESOURCE_GROUP_NAME> —name <APP_NAME> —linux-fx-version “PYTHON|3.12”

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = app_ensure_python_version_is_latest. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks