CVE-2023-51385 and CVE-2023-38408 in Runtime 17.3 LTS in Azure Gov Databricks

[moto-charles]

My org is running Databricks in Azure Gov and recently upgraded from runtime 17.1 to 17.3 LTS.  Around the same time as the upgrade, our security team found 17 CVE's, two of which are related to openssh.  We have already contacted Microsoft and they stated Databricks needed to update the images to use a more recent version of openssh.  Databricks can you confirm this and possibly resolve the CVEs in Azure Gov Databricks?  Thanks

[moto-charles]

CVE-2023-51385 and CVE-2023-38408

[Ashwin_DSA · Accepted solution]

Hi @moto-charles,

For an authoritative statement on CVE‑2023‑51385 and CVE‑2023‑38408 in your specific workspace and region (Azure Gov), the best path is to open a support ticket from your Azure Databricks workspace. That allows Databricks Support and Security to confirm the applicability of these specific CVEs to your configuration and images, and to provide concrete guidance on risk and on any recommended maintenance update or runtime upgrade path.

That way, you get an official answer that your security team can rely on for their assessment and documentation. The community cannot reliably provide this confirmation.

If this answer resolves your question, could you mark it as “Accept as Solution”? That helps other users quickly find the correct fix.