Back to Checks
azure

App Service web app uses the latest supported Python version or 3.12 by default

app_ensure_python_version_is_latest
Service: appSeverity: low
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:microsoft.web/sites

Azure App Service web apps using Python are assessed to confirm the runtime is the latest supported version (e.g., 3.12). The evaluation reads the app's stack configuration to detect Python usage and compares the configured runtime against the defined latest baseline.

Prowler logoProwlerprowler-provider-azure

Risk

Outdated Python runtimes weaken security and reliability:

  • Compromise confidentiality via known interpreter/SSL flaws
  • Undermine integrity through RCE and package exploitation
  • Reduce availability when deprecated versions lose patches and break under load

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks app_ensure_python_version_is_latest

Recommendation

Adopt the latest supported Python minor for App Service and maintain a consistent upgrade policy. Track vendor EOL, test in staging, and roll out via CI/CD.

Apply defense in depth: minimize privileges and enforce strong TLS to reduce exposure during updates.

Remediation

CLI

az webapp config set --resource-group <RESOURCE_GROUP_NAME> --name <APP_NAME> --linux-fx-version "PYTHON|3.12"

Terraform

# Configure the Web App to use the latest Python version
resource "azurerm_linux_web_app" "<example_resource_name>" {
  name                = "<example_resource_name>"
  resource_group_name = "<example_resource_name>"
  location            = "<example_location>"
  service_plan_id     = "<example_resource_id>"

  site_config {
    application_stack {
      python_version = "3.12" # Critical: sets Python runtime to 3.12 to pass the check
    }
  }
}

NativeIaC

// Set the Web App runtime to the latest Python version
resource app 'Microsoft.Web/sites@2022-03-01' existing = {
  name: '<example_resource_name>'
}

resource config 'Microsoft.Web/sites/config@2022-03-01' = {
  name: '${app.name}/web'
  properties: {
    linuxFxVersion: 'PYTHON|3.12' // Critical: sets Python runtime to 3.12 to pass the check
  }
}

Other

1In the Azure portal, go to App Services and select your app
2Go to Settings > Configuration > General settings
3Under Stack settings, set Python version to 3.12
4Click Save and confirm the restart

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.app.app_client import app_client


class app_ensure_python_version_is_latest(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for (
            subscription_id,
            apps,
        ) in app_client.apps.items():
            subscription_name = app_client.subscriptions.get(
                subscription_id, subscription_id
            )
            for app in apps.values():
                framework = getattr(app.configurations, "linux_fx_version", "")

                if "python" in framework.lower() or getattr(
                    app.configurations, "python_version", ""
                ):
                    report = Check_Report_Azure(metadata=self.metadata(), resource=app)
                    report.subscription = subscription_id
                    report.status = "FAIL"
                    python_latest_version = app_client.audit_config.get(
                        "python_latest_version", "3.12"
                    )
                    report.status_extended = f"Python version is '{framework}', the latest version that you could use is the '{python_latest_version}' version, for app '{app.name}' in subscription '{subscription_name} ({subscription_id})'."

                    if (
                        python_latest_version in framework
                        or getattr(app.configurations, "python_version", None)
                        == python_latest_version
                    ):
                        report.status = "PASS"
                        report.status_extended = f"Python version is set to '{python_latest_version}' for app '{app.name}' in subscription '{subscription_name} ({subscription_id})'."

                    findings.append(report)

        return findings

References