CVE-2025-2327: FlashArray KEK Logging Vulnerability
Published Jun 16, 2025
·Updated
A flaw exists in FlashArray whereby the Key Encryption Key (KEK) is logged during key rotation when RDL is configured.
Affected Software
1 affected component
Pure Storage FlashArray
Remediation
Information
This issue is resolved in the following FlashArray Purity (OE) versions
* Purity//FA 6.5.11
* Purity//FA 6.7.4
* Purity//FA 6.8.6
Event History
Jun 16, 2025
CVE Published
via MITRE·04:23 PM
Data Sourced
via MITRE·04:23 PM
RemedyDescriptionWeakness
Data Sourced
via NVD·05:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-2327?
CVE-2025-2327 has been rated as a medium severity vulnerability due to the potential exposure of sensitive encryption keys.
2
How do I fix CVE-2025-2327?
To fix CVE-2025-2327, ensure that key rotation procedures are updated to prevent logging of the Key Encryption Key (KEK) when RDL is configured.
3
What systems are affected by CVE-2025-2327?
CVE-2025-2327 specifically affects Pure Storage FlashArray devices.
4
What impact does CVE-2025-2327 have on data security?
CVE-2025-2327 can lead to unauthorized access or decryption of sensitive data if the Key Encryption Key is compromised.
5
When was CVE-2025-2327 disclosed?
CVE-2025-2327 was disclosed in 2025, highlighting a flaw in the logging mechanism during key rotation.