topic Re: CVE-2023-51385 and CVE-2023-38408 in Runtime 17.3 LTS in Azure Gov Databricks in Data Engineering

CVE-2023-51385 and CVE-2023-38408 in Runtime 17.3 LTS in Azure Gov Databricks

moto-charles — Tue, 17 Mar 2026 19:22:19 GMT

My org is running Databricks in Azure Gov and recently upgraded from runtime 17.1 to 17.3 LTS. Around the same time as the upgrade, our security team found 17 CVE's, two of which are related to openssh. We have already contacted Microsoft and they stated Databricks needed to update the images to use a more recent version of openssh. Databricks can you confirm this and possibly resolve the CVEs in Azure Gov Databricks? Thanks

Re: CVE-2023-51385 and CVE-2023-38408 in Runtime 17.3 LTS in Azure Gov Databricks

moto-charles — Tue, 17 Mar 2026 19:22:49 GMT

CVE-2023-51385 and CVE-2023-38408

Re: CVE-2023-51385 and CVE-2023-38408 in Runtime 17.3 LTS in Azure Gov Databricks

Ashwin_DSA — Wed, 25 Mar 2026 10:31:55 GMT

Hi @moto-charles,

For an authoritative statement on CVE‑2023‑51385 and CVE‑2023‑38408 in your specific workspace and region (Azure Gov), the best path is to open a support ticket from your Azure Databricks workspace. That allows Databricks Support and Security to confirm the applicability of these specific CVEs to your configuration and images, and to provide concrete guidance on risk and on any recommended maintenance update or runtime upgrade path.

That way, you get an official answer that your security team can rely on for their assessment and documentation. The community cannot reliably provide this confirmation.

If this answer resolves your question, could you mark it as “Accept as Solution”? That helps other users quickly find the correct fix.