Risk Level: Low
Cloud Entity: Web Apps service
CloudGuard Rule ID: D9.AZU.CRY.43
Covered by Spectral: No
Category: Compute

GSL LOGIC

WebApp where config.linuxFxVersion regexMatch /JAVA*/ should have config.linuxFxVersion regexMatch /JAVA|[11,17]/

REMEDIATION

From Portal

Login to Azure Portal using https://portal.azure.com.
Go to 'App Services'.
Click on each Linux WebApp.
Under 'Settings' section, click on 'Configuration'.
Click on the General settings pane and ensure that for a Stack of Java, with Major Version of Java 11, and regardless of the Java web server being used, that the Java web server version is set to the auto-update option (This will ensure that the web server is always up-to-date).
Click Save.

NOTE: No action is required If Java version is set to Off as Java is not used by your web app.At the time of Rule creation the acceptable JAVA versions are 11 and 17.

From TF

Set the latest Java version as below:

resource "azurerm_linux_web_app" "example" {
	..
	site_config {
		..
		application_stack{
			Java_version = "Latest-Java-Version"
		}
		..
	}
	..
}

From Command Line

To see the list of supported runtimes:

az webapp list-runtimes --os linux | grep Java

To set latest Java version for an existing app, run the following command:

az webapp config set --resource-group RESOURCEGROUP --name WEBAPP --linux-fx-version VERSION

References

Web Apps service

Azure App Service is an HTTP-based service for hosting web applications, REST APIs, and mobile back ends. You can develop in your favorite language, be it .NET, .NET Core, Java, Ruby, Node.js, PHP, or Python. Applications run and scale with ease on both Windows and Linux-based environments.

Compliance Frameworks

Azure CIS Foundations v. 1.2.0
Azure CIS Foundations v. 1.3.0
Azure CIS Foundations v. 1.3.1
Azure CIS Foundations v. 1.4.0
Azure CIS Foundations v. 1.5.0
Azure CloudGuard Best Practices
CloudGuard Azure All Rules Ruleset