Key Encryption Key Logging Flaw in FlashArray by Pure Storage
CVE-2025-2327

5.1MEDIUM

Key Information:

Vendor

Pure Storage

Status
Flasharray
Vendor
CVE Published:
16 June 2025

What is CVE-2025-2327?

A security vulnerability has been identified in Pure Storage's FlashArray that allows the Key Encryption Key (KEK) to be logged during the key rotation process when the Retention Data Log (RDL) is configured. This flaw could potentially expose sensitive cryptographic details, impacting the overall security integrity of data management. Users are advised to review their FlashArray configurations and monitor for any unauthorized access during key rotations.

Affected Version(s)

FlashArray Purity 6.0.0 <= 6.0.9

FlashArray Purity 6.1.0 <= 6.1.25

FlashArray Purity 6.2.0 <= 6.2.17

References

https://support.purestorage.com/category/m_pure_storage_p...

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-2327 : Key Encryption Key Logging Flaw in FlashArray by Pure Storage