Control: 9.8 Ensure that 'Java version' is the latest, if used to run the web app
Description
Periodically, newer versions are released for Java software either due to security flaws or to include additional functionality. Using the latest Java version for web apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the newer version.
Newer versions may contain security enhancements and additional functionality. With each software installation, organizations need to determine if a given update meets their requirements and also verify the compatibility and support provided for any additional software against the update revision that is selected.
Remediation
From Console
Perform the following action to check latest version installed:
- Login to Azure Portal and go to
App Services
. - Click on each App.
- Under
Settings
section, click onConfiguration
. - Go to
General settings
tab. - Under
Stack settings
, ensureJava version
is set to latest version.
Note No action is required, If Stack is not using Java, as it is not used by your web app.
Perform the following action to install latest version:
- Login to Azure Portal and go to
App Services
. - Click on each App.
- Under
Settings
section, click onConfiguration
. - Go to
General settings
tab. - Under
Stack settings
, setJava version
to the latest version. - Set
Java minor version
to latest version available. - Set
Java web server
to latest version available. - Set
Java web server version
to latest version available. - Click
Save
.
From Command Line
To see the list of supported runtimes:
az webapp list-runtimes | grep java
To set latest Java version for an existing app, run the following command:
az webapp config set --resource-group <RESOURCE_GROUP_NAME> --name <APP_NAME> --java-version '1.8' --java-container 'Tomcat' --java-container-version '<VERSION>'
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.cis_v130_9_8
Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.cis_v130_9_8 --share
SQL
This control uses a named query:
manual_control