Product Security Vulnerability Response and Remediation Policy

Reporting Security Vulnerabilities

Potential vulnerabilities or incidents impacting Everpure's products or services can be reported to psirt@purestorage.com. We highly encourage sending us a secure email using our Contact Pure Security page.

Pure's Product Security & Incident Response Team (PSIRT) will receive and promptly investigate the reported vulnerabilities. The response timelines may vary on factors such as scope, complexity, severity and impact. If the vulnerability is determined to be valid, it will be prioritized based on the impact, likelihood and exploitability of the reported vulnerability.

Please refer to the Vulnerability Reporting and Disclosure Policy for additional information about Responsible Disclosure, Safe Harbor and Bug Bounty Program

How Everpure Scores Vulnerabilities

Everpure uses industry standard Common Vulnerability Scoring System (CVSS 4.0) to assess and determine the vulnerability score. The following criteria must be met for scoring vulnerabilities:

• Must be a valid vulnerability in Everpure maintained code.

• The vulnerability must exist in supported versions of the products.

Everpure’s vulnerability scoring is aligned with standards defined by Forum of Incident Response and Security Teams (FIRST.org). Refer to the table below:

Security Bulletins & Advisories

Everpure will disclose security vulnerabilities and appropriate mitigations through our security bulletins and advisories/notices. The security bulletins will include at a minimum the following information:

Customers can view a more comprehensive list of vulnerabilities in Pure's CVE Database.

On a case-by-case basis, Pure may publish a security bulletin to acknowledge a publicly known security vulnerability, and to provide guidance regarding when (or where) additional information will be available. Security advisories/notices may also be published for security related events and its impact on Pure products.

Pure may on occasion also determine that based on the scope, impact, and affected install base of a security vulnerability, email notification may also be required to alert our customers of critical vulnerabilities that require immediate attention inline with our privacy policy.

Pure may publish security related articles to share information about security-related topics such as:

The above information can be found in Security Resources and Certifications.

The following table identities how Everpure provides customer facing information regarding security vulnerabilities.

Pure security bulletins and advisories are available at https://purestorage.com/security.

End of Life Policy

All Pure Products and services are subject to Pure's End-of-Product Lifecycle. For additional information, please see the End of Product Life Cycle and Upgrade Policy in Everpure End User License Agreement (EULA).

Customers can navigate to the End-of-Product Lifecycle Overview for information on Pure’s software and hardware lifecycle including end-of-life dates.

Flash Array End of Product Life Cycle (EOL):

Flash Blade End of Product Life Cycle (EOL):

Please see FlashArray Hardware and End Of Support and FlashBlade Hardware and End of Support for Hardware/Purity compatibility.

We recommend that customers review our Product Release Notes for guidance on known fixed issues by release:

• FlashArray Release Notes.

• FlashBlade Release Notes

We also recommend for customers to stay up-to-date with the latest software to ensure they benefit from the security improvements and vulnerability fixes. Features such as Self-service Upgrade (SSU) are now available in certain Purity versions to make the upgrade process streamlined and efficient.

Purity Self-Service Upgrades for FlashArray™ Video Course is now available for Pure employees.