ben.carrasco/prowler
1
0 Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-10-23 20:04:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore(azure): raise App Service PHP latest version default to 8.5 (#13128)

Browse Source
This commit is contained in:
Rubén De la Torre Vico authored and GitHub committed 2026-10-22 15:33:06 +02:00
1 parent f26b9776d4
commit 69b80f6a3f
10 files changed
+15 -13
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

contrib/k8s/helm/prowler-api/values.yaml
+1 -1
View File
@@ -502,7 +502,7 @@ mainConfig:
# Azure App Service
# azure.app_ensure_php_version_is_latest
php_latest_version: "8.2"
php_latest_version: "8.5"
# azure.app_ensure_python_version_is_latest
python_latest_version: "3.12"
# azure.app_ensure_java_version_is_latest
docs/user-guide/cli/tutorials/configuration_file.mdx
+2 -2
View File
@@ -214,7 +214,7 @@ The following list includes all the Azure checks with configurable variables tha
| `apim_threat_detection_llm_jacking` | `apim_threat_detection_llm_jacking_minutes` | Integer | `1440` |
| `apim_threat_detection_llm_jacking` | `apim_threat_detection_llm_jacking_threshold` | Float | `0.1` |
| `app_ensure_java_version_is_latest` | `java_latest_version` | String | `"17"` |
| `app_ensure_php_version_is_latest` | `php_latest_version` | String | `"8.2"` |
| `app_ensure_php_version_is_latest` | `php_latest_version` | String | `"8.5"` |
| `app_ensure_python_version_is_latest` | `python_latest_version` | String | `"3.12"` |
| `defender_attack_path_notifications_properly_configured` | `defender_attack_path_minimal_risk_level` | String | `"High"` |
| `network_public_ip_shodan` | `shodan_api_key` | String | `null` |
@@ -719,7 +719,7 @@ azure:
# Azure App Service
# azure.app_ensure_php_version_is_latest
php_latest_version: "8.2"
php_latest_version: "8.5"
# azure.app_ensure_python_version_is_latest
python_latest_version: "3.12"
# azure.app_ensure_java_version_is_latest
prowler/changelog.d/azure-php-latest-version-8-5.changed.md
+1
View File
@@ -0,0 +1 @@
Default `php_latest_version` for `app_ensure_php_version_is_latest` raised from `8.2` to `8.5`, the newest PHP runtime on Azure App Service for Linux, following the PHP2Shell (CVE-2026-109618, CVE-2026-109619) security release
prowler/config/config.yaml
+1 -1
View File
@@ -551,7 +551,7 @@ azure:
# Azure App Service
# azure.app_ensure_php_version_is_latest
php_latest_version: "8.2"
php_latest_version: "8.5"
# azure.app_ensure_python_version_is_latest
python_latest_version: "3.12"
# azure.app_ensure_java_version_is_latest
prowler/config/schema/azure.py
+1 -1
View File
@@ -36,7 +36,7 @@ class AzureProviderConfig(ProviderConfigBase):
# --- App Service ----------------------------------------------------
php_latest_version: Annotated[
Optional[str], AfterValidator(_validate_dotted_version)
] = Field(default=None, description='PHP minimum acceptable version, e.g. "8.2".')
] = Field(default=None, description='PHP minimum acceptable version, e.g. "8.5".')
python_latest_version: Annotated[
Optional[str], AfterValidator(_validate_dotted_version)
] = Field(
prowler/providers/azure/services/app/app_ensure_php_version_is_latest/app_ensure_php_version_is_latest.metadata.json
+5 -5
View File
@@ -1,7 +1,7 @@
{
"Provider": "azure",
"CheckID": "app_ensure_php_version_is_latest",
"CheckTitle": "App Service web app uses the latest supported PHP version or 8.2 by default",
"CheckTitle": "App Service web app uses the latest supported PHP version or 8.5 by default",
"CheckType": [],
"ServiceName": "app",
"SubServiceName": "",
@@ -19,10 +19,10 @@
],
"Remediation": {
"Code": {
"CLI": "az webapp config set --resource-group <RESOURCE_GROUP_NAME> --name <APP_NAME> --linux-fx-version \"PHP|8.2\"",
"NativeIaC": "```bicep\n// Update App Service runtime to latest PHP\nresource appConfig 'Microsoft.Web/sites/config@2022-09-01' = {\n name: '<example_resource_name>/web'\n properties: {\n linuxFxVersion: 'PHP|8.2' // Critical: sets the app runtime to PHP 8.2 (latest) to pass the check\n }\n}\n```",
"Other": "1. In Azure Portal, go to App Services and select your app\n2. Navigate to Settings > Configuration > General settings\n3. Under Stack settings, select PHP and set Version to 8.2\n4. Click Save and confirm the restart",
"Terraform": "```hcl\n# Set latest PHP version on Linux Web App\nresource \"azurerm_linux_web_app\" \"app\" {\n name = \"<example_resource_name>\"\n resource_group_name = \"<example_resource_name>\"\n location = \"<example_location>\"\n service_plan_id = \"<example_resource_id>\"\n\n site_config {\n application_stack {\n php_version = \"8.2\" # Critical: sets PHP to latest to pass the check\n }\n }\n}\n```"
"CLI": "az webapp config set --resource-group <RESOURCE_GROUP_NAME> --name <APP_NAME> --linux-fx-version \"PHP|8.5\"",
"NativeIaC": "```bicep\n// Update App Service runtime to latest PHP\nresource appConfig 'Microsoft.Web/sites/config@2022-09-01' = {\n name: '<example_resource_name>/web'\n properties: {\n linuxFxVersion: 'PHP|8.5' // Critical: sets the app runtime to PHP 8.5 (latest) to pass the check\n }\n}\n```",
"Other": "1. In Azure Portal, go to App Services and select your app\n2. Navigate to Settings > Configuration > General settings\n3. Under Stack settings, select PHP and set Version to 8.5\n4. Click Save and confirm the restart",
"Terraform": "```hcl\n# Set latest PHP version on Linux Web App\nresource \"azurerm_linux_web_app\" \"app\" {\n name = \"<example_resource_name>\"\n resource_group_name = \"<example_resource_name>\"\n location = \"<example_location>\"\n service_plan_id = \"<example_resource_id>\"\n\n site_config {\n application_stack {\n php_version = \"8.5\" # Critical: sets PHP to latest to pass the check\n }\n }\n}\n```"
},
"Recommendation": {
"Text": "Standardize on the **latest supported PHP** and avoid EoL releases. Update promptly after security advisories, validate in staging, and automate version governance across apps. Prefer supported Linux runtimes, limit optional extensions, and apply **defense in depth** and **least privilege** to reduce blast radius.",
prowler/providers/azure/services/app/app_ensure_php_version_is_latest/app_ensure_php_version_is_latest.py
+1 -1
View File
@@ -24,7 +24,7 @@ class app_ensure_php_version_is_latest(Check):
report.status = "FAIL"
php_latest_version = app_client.audit_config.get(
"php_latest_version", "8.2"
"php_latest_version", "8.5"
)
report.status_extended = f"PHP version is set to '{framework}', the latest version that you could use is the '{php_latest_version}' version, for app '{app.name}' in subscription '{subscription_name} ({subscription_id})'."
tests/providers/azure/azure_provider_test.py
+1 -1
View File
@@ -83,7 +83,7 @@ class TestAzureProvider:
)
assert azure_provider.audit_config == {
"shodan_api_key": None,
"php_latest_version": "8.2",
"php_latest_version": "8.5",
"python_latest_version": "3.12",
"java_latest_version": "17",
"recommended_minimal_tls_versions": ["1.2", "1.3"],
ui/changelog.d/azure-php-latest-version-8-5.changed.md
+1
View File
@@ -0,0 +1 @@
Default `php_latest_version` in the scan configuration template raised from `8.2` to `8.5`
ui/lib/yaml.ts
+1 -1
View File
@@ -288,7 +288,7 @@ aws:
azure:
defender_attack_path_minimal_risk_level: "High"
php_latest_version: "8.2"
php_latest_version: "8.5"
python_latest_version: "3.12"
java_latest_version: "17"
vm_backup_min_daily_retention_days: 7