Pipeline: 9.7 Ensure that 'PHP version' is currently supported (if in use)
Description
Periodically, older versions of PHP may be deprecated and no longer supported. Using a supported version of PHP for app services is recommended to avoid potential unpatched vulnerabilities.
Deprecated and unsupported versions of programming and scripting languages can present vulnerabilities which may not be addressed or may not be addressable.
Remediation
From Azure Portal
- From Azure Home open the Portal Menu in the top left.
- Go to
App Services
. - Click on each App.
- Under
Settings
section, click onConfiguration
. - Click on the
General settings
pane, ensure that for aStack
ofPHP
theMajor Version
andMinor Version
reflect a currently supported release.
NOTE: No action is required If PHP version
is set to Off
or is set with an empty value as PHP is not used by your app.
From Azure CLI
List the available PHP runtimes:
az webapp list-runtimes
To set a currently supported PHP version for an existing app, run the following command:
az webapp config set --resource-group <RESOURCE_GROUP_NAME> --name <APP_NAME> [--linux-fx-version <PHP_RUNTIME_VERSION>][--php-version <PHP_VERSION>]
From Powershell
To set a currently supported PHP version for an existing app, run the following command:
Set-AzWebApp -ResourceGroupName <RESOURCE_GROUP_NAME> -Name <APP_NAME> -phpVersion <PHP_VERSION>
NOTE: Currently there is no way to update an existing web app Linux FX Version
setting using PowerShell, nor is there a way to create a new web app using PowerShell that configures the PHP runtime in the Linux FX Version
setting.
Default Value
The version of PHP is whatever was selected upon App creation.
Run the pipeline
To run this pipeline from your terminal:
flowpipe pipeline run azure_cis.pipeline.cis_v300_9_7
Use this pipeline
To call this pipeline from your pipeline, use a step:
step "pipeline" "step_name" { pipeline = azure_cis.pipeline.cis_v300_9_7 }
Params
Name | Type | Required | Description | Default |
---|---|---|---|---|
database | connection.steampipe | Yes | Database connection string. | connection.steampipe.default |
notifier | notifier | Yes | The name of the notifier to use for sending notification messages. | notifier.default |
notification_level | string | Yes | The verbosity level of notification messages to send. Valid options are 'verbose', 'info', 'error'. | info |
approvers | list(notifier) | Yes | List of notifiers to be used for obtaining action/approval decisions. | notifier.default |
Outputs
This pipeline has no outputs.