App Service Linux Python 3.13 image: Flask/virtualenv security fixes, rollout and recovery

Hello @Paul

Thanks for providing the exact image tag, SHA256 digest, package versions, and vulnerability references. You've also made an important distinction between upstream security advisories and confirmed exploitability in Azure App Service.

Since this concerns a Microsoft-maintained built-in Python 3.13 image, I agree that updating application dependencies alone may not fully address the packages installed in the platform's base environment.

Let me address your questions individually.

1. Are the security fixes backported into the image?

Azure App Service manages operating system and runtime patching and uses safe deployment practices to minimize service disruption.

However, I couldn't find public Microsoft documentation confirming whether the specific image digest you provided contains backported fixes for Flask, virtualenv, or appsvc-code-profiler.

Package version numbers alone don't conclusively establish vulnerability status because vendors may backport fixes without changing upstream version numbers.

For this particular image, Microsoft would need to confirm the applied patches or provide the relevant security assurance information.

2. Which Python 3.13 image contains the fixes?

The Platform Release Channel feature controls runtime patch rollout timing on Linux App Service.

However, I couldn't verify a Microsoft-published Python 3.13 image digest that resolves all the advisories you've identified, or a confirmed rollout date for such an image on the Standard channel.

I recommend confirming with the App Service engineering team before changing your production environment.

3. Is updating the application virtual environment sufficient?

Not necessarily.

Python applications deployed with build automation use a virtual environment for application dependencies.

Updating packages in that environment can address vulnerabilities in the application's installed dependencies, but it doesn't automatically update packages installed in the Microsoft-managed base image.

The remaining question is whether the affected base-image packages are actually imported or executed in a vulnerable context.

That requires examining their usage within the App Service runtime, rather than relying exclusively on package inventory.

4. What is the supported recovery path if a runtime update fails?

Microsoft documents deployment slots and application deployment rollback strategies for managing application changes.

However, these mechanisms shouldn't be interpreted as guaranteed rollback capabilities for Microsoft-managed runtime images.

Redeploying an earlier application package or swapping deployment slots doesn't guarantee restoration of a previously used platform image digest.

For production workloads, I recommend validating application behavior in a staging environment before adopting a new runtime configuration and having a recovery plan for application-level changes.

If a Microsoft-managed runtime update causes a platform-level regression, Microsoft Support should investigate the affected image and available remediation options.

5. Where can customers obtain security assurance for appsvc-code-profiler?

I couldn't find a public Microsoft security advisory or package-specific update record establishing the vulnerability status of appsvc-code-profiler 1.0.0 in the image you identified.

Since this is a Microsoft-supplied component, I recommend confirming directly with the App Service engineering team rather than attempting to modify or remove it from the managed runtime.

Recommended next step

Given the specificity of your findings, I recommend opening an Azure App Service technical support request and asking for an image-level security assessment.

Include the exact image tag and digest, observed package versions, associated GHSA advisories, and the results of your isolated container testing.

Specifically request confirmation of:

• Whether the identified vulnerabilities are applicable to the Microsoft-maintained runtime image.
• Whether any fixes have been backported.
• The first remediated image digest, if available, and its rollout status on the Standard channel.
• The supported mitigation and recovery approach for affected production applications.
• The security maintenance status of appsvc-code-profiler.

I don't recommend modifying the built-in image or assuming that application-level package updates remediate every finding without this confirmation.

Your findings provide useful evidence for an engineering investigation, but don't classify the specific image as patched or vulnerable in production without confirming the relevant package usage and Microsoft-maintained fixes.

Hope this helps clarify the supported next steps.

References:

• OS and runtime patching in Azure App Service
• Configure a Linux Python app for Azure App Service
• Operating system functionality in Azure App Service
• Configure custom containers for Azure App Service
• Create an Azure Support request

Help make this community better for everyone: If this answer helped or resolved your issue, please accept it or upvote it. If not, share more details in a comment so we can continue the discussion and find the right solution. Thank you.