{"uuid": "2855f72a-092f-45d2-8bdb-1865aa68c150", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-14847", "type": "seen", "source": "https://gist.github.com/ef-edulog/af8c5bdd8a1e18cdbda9ef4316c0d6ea", "content": "\n\n\n\n\nJira Report \u2014 DO / IM / S2\n\n :root {\n --bg: #fff; --bg2: #f5f4ef; --bg3: #ebebeb;\n --tx: #1a1a1a; --tx2: #666660; --tx3: #999994;\n --info: #185FA5; --bdr: rgba(0,0,0,0.12); --bdr2: rgba(0,0,0,0.22);\n --r: 8px; --rl: 12px;\n --font: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;\n --mono: 'SF Mono','Fira Code',monospace;\n }\n @media(prefers-color-scheme:dark){\n :root{--bg:#1e1e1c;--bg2:#2a2a28;--bg3:#333330;--tx:#f0efe8;--tx2:#a8a79f;--tx3:#6e6e68;--info:#85B7EB;--bdr:rgba(255,255,255,0.1);--bdr2:rgba(255,255,255,0.18)}\n }\n *{box-sizing:border-box;margin:0;padding:0}\n body{font-family:var(--font);background:var(--bg);color:var(--tx);padding:24px;max-width:1300px;margin:0 auto}\n h1{font-size:18px;font-weight:500;margin-bottom:4px}\n .sub{font-size:12px;color:var(--tx2);margin-bottom:20px}\n .tabs{display:flex;gap:6px;margin-bottom:1.25rem;flex-wrap:wrap}\n .tab{padding:5px 13px;border:0.5px solid var(--bdr2);border-radius:var(--r);font-size:13px;cursor:pointer;background:var(--bg);color:var(--tx2)}\n .tab.active{background:var(--bg2);color:var(--tx);font-weight:500}\n .tab:hover:not(.active){background:var(--bg2)}\n .legend{display:flex;gap:14px;flex-wrap:wrap;margin-bottom:1rem;font-size:11px;color:var(--tx2);align-items:center}\n .li{display:flex;align-items:center;gap:4px}\n .ld{width:9px;height:9px;border-radius:2px}\n .summary-grid{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:8px;margin-bottom:1.25rem}\n .metric{background:var(--bg2);border-radius:var(--r);padding:10px 12px}\n .ml{font-size:11px;color:var(--tx2);margin-bottom:3px}\n .mv{font-size:20px;font-weight:500}\n .project-block{margin-bottom:1.1rem;border:0.5px solid var(--bdr);border-radius:var(--rl);overflow:hidden}\n .ph{padding:9px 14px;border-bottom:0.5px solid var(--bdr);display:flex;align-items:center;justify-content:space-between}\n .pn{font-size:13px;font-weight:500}\n .pm{font-size:11px;color:var(--tx2)}\n .th{padding:5px 14px;font-size:11px;font-weight:500;color:var(--tx2);background:var(--bg2);display:flex;align-items:center;gap:6px;border-top:0.5px solid var(--bdr)}\n .tc{background:var(--bg3);color:var(--tx2);padding:1px 6px;border-radius:var(--r);font-size:10px}\n .cols{display:grid;grid-template-columns:80px 1fr 86px 82px 82px 80px 98px;gap:4px;padding:4px 14px;font-size:10px;color:var(--tx3);background:var(--bg2);border-top:0.5px solid var(--bdr)}\n .ir{display:grid;grid-template-columns:80px 1fr 86px 82px 82px 80px 98px;gap:4px;padding:6px 14px;align-items:start;border-top:0.5px solid var(--bdr);font-size:11px}\n .ir.stale{background:rgba(250,238,218,0.3)}\n .ir.highest{background:rgba(252,235,235,0.35)}\n .ir.overdue{background:rgba(252,235,235,0.45)}\n .ir.stale.highest,.ir.stale.overdue{background:rgba(250,220,200,0.45)}\n @media(prefers-color-scheme:dark){\n .ir.stale{background:rgba(99,56,6,0.2)}.ir.highest{background:rgba(121,31,31,0.2)}\n .ir.overdue{background:rgba(121,31,31,0.3)}.ir.stale.highest,.ir.stale.overdue{background:rgba(110,40,6,0.28)}\n }\n .ik{color:var(--info);font-size:10px;font-family:var(--mono);white-space:nowrap;text-decoration:none}\n .ik:hover{text-decoration:underline}\n .is{color:var(--tx);line-height:1.4;overflow:hidden;display:-webkit-box;-webkit-line-clamp:2;-webkit-box-orient:vertical}\n .ia{color:var(--tx2);font-size:10px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}\n .dt{font-size:10px;white-space:nowrap}\n .upd-ok{color:var(--tx2)}.upd-stale{color:#BA7517;font-weight:500}\n .due-ok{color:var(--tx2)}.due-over{color:#A32D2D;font-weight:500}\n .cr{color:var(--tx2)}\n @media(prefers-color-scheme:dark){.upd-stale{color:#FAC775}.due-over{color:#F7C1C1}}\n .dot-h{display:inline-block;width:5px;height:5px;border-radius:50%;background:#E24B4A;margin-right:2px;vertical-align:middle}\n .dot-s{display:inline-block;width:5px;height:5px;border-radius:50%;background:#EF9F27;margin-right:2px;vertical-align:middle}\n .dot-d{display:inline-block;width:5px;height:5px;border-radius:50%;background:#D85A30;margin-right:2px;vertical-align:middle}\n .sb{font-size:10px;padding:2px 6px;border-radius:var(--r);text-align:center;white-space:nowrap}\n .s-ip{background:#FAEEDA;color:#854F0B}.s-td{background:#E1F5EE;color:#0F6E56}\n .s-oi{background:#FCEBEB;color:#A32D2D}.s-xx{background:var(--bg2);color:var(--tx2)}\n @media(prefers-color-scheme:dark){\n .s-ip{background:#633806;color:#FAC775}.s-td{background:#085041;color:#9FE1CB}.s-oi{background:#791F1F;color:#F7C1C1}\n }\n .empty{padding:16px;text-align:center;color:var(--tx3);font-size:12px}\n .footer{font-size:11px;color:var(--tx3);margin-top:24px}\n\n\n\n\nJira Active Issues Report \u2014 DO / IM / S2\n\nGenerated July 28, 2026 at 04:33 PM  \u00b7  Excludes Done, Fixed, Canceled, Deferred  \u00b7  https://karrostech.atlassian.net\n\nLast 24 hrs24\u201348 hrs ago2\u20137 days agoOlder than 7 days\n\n\n Highest priority\n Stale \u22655 business days\n Due date missed\n\n\n\n\n\nDO \u2014 Edulog DevOps\n2\n\nIM \u2014 Incident Management\n0\n\nS2 \u2014 Soc-2 & Security\n0\n \n\n \n\n DO \u2014 Edulog DevOps\n 2 active issues\n \n \n\n KeySummaryAssignee\n CreatedLast updatedDue dateStatus\n \nATH New site request 1\n \n\n DO-2814\n Athena Deployment - Rosemount, MN\n JD Hawk\n Jul 28, '26\n Jul 28, '26\n Jul 31, '26\n To Do\n \nTask 1\n \n\n DO-2815\n Alexandria, VA - Stop Summer ASDI and Fall Moved Back to Plan \n JD Holwick\n Jul 28, '26\n Jul 28, '26\n \u2014\n IN PROGRESS\n \n\n\n\nDO \u2014 Edulog DevOps\n1\n\nIM \u2014 Incident Management\n1\n\nS2 \u2014 Soc-2 & Security\n0\n \n\n \n\n DO \u2014 Edulog DevOps\n 1 active issue\n \n \n\n KeySummaryAssignee\n CreatedLast updatedDue dateStatus\n \nTask 1\n \n\n DO-2808\n New Berlin, WI - Please update ASDI\n Cory Emlen\n Jul 27, '26\n Jul 28, '26\n \u2014\n Verification\n \n \n\n \n\n IM \u2014 Incident Management\n 1 active issue\n \n \n\n KeySummaryAssignee\n CreatedLast updatedDue dateStatus\n \nStory 1\n \n\n IM-7721\n Cambridge Requesting 6/20/26 Backup Placed in Sandbox (arc2526) \u2014 Do Not Override Plan\n Chukwuemeka Chukwurah\n Jul 27, '26\n Jul 28, '26\n \u2014\n Open Issue\n \n\n\n\nDO \u2014 Edulog DevOps\n12\n\nIM \u2014 Incident Management\n2\n\nS2 \u2014 Soc-2 & Security\n0\n \n\n \n\n DO \u2014 Edulog DevOps\n 12 active issues\n \n \n\n KeySummaryAssignee\n CreatedLast updatedDue dateStatus\n \nATH New site request 1\n \n\n DO-2777\n Highline, WA - Deploy New Athena Site\n JD Hawk\n Jul 22, '26\n Jul 23, '26\n \u2014\n To Do\n \nStory 1\n \n\n DO-2794\n Providence, RI - Update talend no rider logic \n Cory Emlen\n Jul 24, '26\n Jul 28, '26\n \u2014\n Verification\n \nTask 10\n \n\n DO-2795\n Cobb County, GA - Update ASDI to Protect Students From the Deletion List based on Programs or UDF\n Cory Emlen\n Jul 24, '26\n Jul 28, '26\n \u2014\n IN PROGRESS\n \n \n\n DO-2780\n Princeton, NJ - Set Up ASCI\n \u2014\n Jul 22, '26\n Jul 22, '26\n \u2014\n Backlog\n \n \n\n DO-2776\n Wichita, KS - Single Sign On Issues\n Eric Fischl\n Jul 22, '26\n Jul 23, '26\n \u2014\n Backlog\n \n \n\n DO-2771\n San Bernardino CA Decommission (clone site)\n \u2014\n Jul 22, '26\n Jul 22, '26\n \u2014\n To Do\n \n \n\n DO-2770\n Portsmouth Public Schools Decommission (clone site)\n \u2014\n Jul 22, '26\n Jul 22, '26\n \u2014\n To Do\n \n \n\n DO-2769\n Mansfield Independent School District (put on ice)\n \u2014\n Jul 22, '26\n Jul 22, '26\n \u2014\n To Do\n \n \n\n DO-2767\n Houston County Board of Education, GA [Summer] (put on ice)\n \u2014\n Jul 22, '26\n Jul 22, '26\n \u2014\n To Do\n \n \n\n DO-2766\n Decommission East Allen County Schools (Clone Site)\n \u2014\n Jul 22, '26\n Jul 22, '26\n \u2014\n To Do\n \n \n\n DO-2764\n Brooks County Schools GA (put on ice)\n \u2014\n Jul 22, '26\n Jul 22, '26\n \u2014\n To Do\n \n \n\n DO-2763\n Decommission Athena for Birdville Independent School District (clone site)\n \u2014\n Jul 22, '26\n Jul 22, '26\n \u2014\n To Do\n \n \n\n \n\n IM \u2014 Incident Management\n 2 active issues\n \n \n\n KeySummaryAssignee\n CreatedLast updatedDue dateStatus\n \nStory 2\n \n\n IM-7710\n CLONE - KNOX COUNTY zonar substitutions down\n Boluwatife Olaifa\n Jul 22, '26\n Jul 28, '26\n \u2014\n Open Issue\n \n \n\n IM-7709\n PPF - Kansas City KS - Vehicle assignments not showing in app\n Vader\n Jul 22, '26\n Jul 28, '26\n \u2014\n WORK IN PROGRESS\n \n\n\n\nDO \u2014 Edulog DevOps\n31\n\nIM \u2014 Incident Management\n10\n\nS2 \u2014 Soc-2 & Security\n9\n \n\n \n\n DO \u2014 Edulog DevOps\n 31 active issues\n \n \n\n KeySummaryAssignee\n CreatedLast updatedDue dateStatus\n \nBug 3\n \n\n DO-2689\n Athena V2 backend ignores per-tenant dbssl -> sales-demo /v2/dispatcher (+Vehicles/Drivers/Locations) 500; RDS rejects 'no pg_hba.conf entry ... no encryption'\n MacBobby Chibuzor\n Jul 9, '26\n Jul 17, '26 (7d)\n \u2014\n Verification\n \n \n\n DO-1786\n [EastAllen, IN 1.78 Smoke]CA Result CSV \u2013 Export fails for valid dates with 400 Bad Request (invalid page number)\n Dane Elwood\n Mar 17, '26\n Mar 26, '26 (88d)\n \u2014\n Blocked\n \n \n\n DO-1512\n 500 Internal Server Err on Search API [UAT01/1.78]\n Vader\n Feb 27, '26\n May 29, '26 (42d)\n \u2014\n To Do\n \nStory 3\n \n\n DO-2711\n FFCA, AB - Changes to Talend script\n Cory Emlen\n Jul 13, '26\n Jul 28, '26\n \u2014\n IN PROGRESS\n \n \n\n DO-2235\n San Bernardino, CA - SY2627 Data Area - delete stops \n Nathan Bible\n Jun 9, '26\n Jun 12, '26 (32d)\n \u2014\n Backlog\n \n \n\n DO-1112\n Lake Superior, MN Clone - Map Work Package\n David Goldberg\n Nov 20, '25\n Mar 9, '26 (101d)\n \u2014\n IN PROGRESS\n \nTask 25\n \n\n DO-2755\n Fayette, TN - Add Additional UDFs into ASDI/Talend\n JD Holwick\n Jul 21, '26\n Jul 27, '26\n \u2014\n IN PROGRESS\n \n \n\n DO-2752\n Adelanto CA - Set up Driver Portal for Tablets and Employees in T&A\n JD Holwick\n Jul 21, '26\n Jul 28, '26\n Jul 27, '26\n IN PROGRESS\n \n \n\n DO-2751\n Stokes County, NC - Setup Driver Portal with Athena T&A\n JD Holwick\n Jul 21, '26\n Jul 23, '26\n Jul 28, '26\n Backlog\n \n \n\n DO-2724\n St. Tammany, LA - Setup ASDI\n Cory Emlen\n Jul 16, '26\n Jul 28, '26\n \u2014\n IN PROGRESS\n \n \n\n DO-2723\n Henrico-va : Increase the routing service resources for site build. Will reduce after build.\n JD Hawk\n Jul 16, '26\n Jul 16, '26 (8d)\n \u2014\n IN PROGRESS\n \n \n\n DO-2722\n Collinsville, IL - Update ASDI to Allow Manual Changes to Program, HomeStop, and No-Rider Again\n Cory Emlen\n Jul 16, '26\n Jul 28, '26\n \u2014\n IN PROGRESS\n \n \n\n DO-2718\n sales-demo V2 Live Map: Google Maps fails (Map ID 722e55505abb306e4fe6b902 / mapConfigs 504)\n MacBobby Chibuzor\n Jul 15, '26\n Jul 17, '26 (7d)\n \u2014\n Backlog\n \n \n\n DO-2717\n sales-demo / newport-news-demo: enroll V1\u2192V2 legacy CDC + fix dual-map data hygiene (depot, tenant header)\n MacBobby Chibuzor\n Jul 15, '26\n Jul 17, '26 (7d)\n \u2014\n Verification\n \n \n\n DO-2716\n sales-demo: Adam Nelson hitting \"no access\" on login (athena-nonprod)\n MacBobby Chibuzor\n Jul 15, '26\n Jul 15, '26 (9d)\n \u2014\n Backlog\n \n \n\n DO-2709\n sales-demo nonprod: Sara Corbally No Access after login (no features enabled)\n MacBobby Chibuzor\n Jul 13, '26\n Jul 16, '26 (8d)\n \u2014\n Verification\n \n \n\n DO-2702\n Kansas City, KS - Please Set Up ASDI\n Cory Emlen\n Jul 13, '26\n Jul 28, '26\n \u2014\n IN PROGRESS\n \n \n\n DO-2473\n AV2 parent SMS (SNS): wire +18667248105 as default origination, exit sandbox, IAM/IaC on AthenaV2SecretGetter\n \u2014\n Jun 25, '26\n Jun 29, '26 (21d)\n \u2014\n Backlog\n \n \n\n DO-2446\n Kansas City, KS - Athena/Parent Portal Integration\n Vader\n Jun 24, '26\n Jul 6, '26 (16d)\n Jul 1, '26\n Verification\n \n \n\n DO-2364\n Shared School Services - Set up GTS integration\n Kehinde Metibemu\n Jun 16, '26\n Jun 22, '26 (26d)\n Jun 18, '26\n Backlog\n \n \n\n DO-2245\n Newport News, VA - Athena SSO\n Vader\n Jun 10, '26\n Jul 17, '26 (7d)\n \u2014\n IN PROGRESS\n \n \n\n DO-2218\n Johnston, NC - Clone - Stop Checking\n Dan McGuire\n Jun 8, '26\n Jun 10, '26 (34d)\n \u2014\n Backlog\n \n \n\n DO-2101\n Add workforce.edulog.com hosts to Keycloak `driver-portal` client Web Origins + Valid Redirect URIs (3 realms)\n Brandon Donnelson\n May 18, '26\n May 18, '26 (51d)\n \u2014\n IN PROGRESS\n \n \n\n DO-2099\n Add 6 Namecheap CNAMEs for workforce.edulog.com (DP V2 web SPA) + update 3 CloudFront distros with alias + ACM cert\n Brandon Donnelson\n May 18, '26\n May 18, '26 (51d)\n \u2014\n IN PROGRESS\n \n \n\n DO-2006\n Remove non-active Tenants from Grafana Plan Ingestion Global Audit\n JD Hawk\n Aug 25, '25\n Jun 22, '26 (26d)\n \u2014\n To Do\n \n \n\n DO-1810\n Brevard-FL - Update Tenant Reports \"Bulletin Bus Run\" \n Manuel Esquivel\n Mar 20, '26\n Jun 24, '26 (24d)\n \u2014\n Backlog\n \n \n\n DO-1748\n San Bernardino, CA - Scan History is showing the wrong time\n Brandon Donnelson\n Mar 11, '26\n Jul 23, '26\n \u2014\n IN PROGRESS\n \n \n\n DO-1158\n Patch CVE-2025-14847 for Mongo Services running 8.0.4\n Vader\n Dec 24, '25\n Jul 6, '26 (16d)\n \u2014\n On hold\n \n \n\n DO-1125\n Update Crush SG/NACL to not allow internet traffic and restrict to the AWS VPN\n Vader\n Dec 3, '25\n Jul 27, '26\n \u2014\n On hold\n \n \n\n DO-1013\n Move all athena-legacy EC2 Instances to have Encrypted EBS Volumes\n Vader\n Oct 29, '25\n Jun 30, '26 (20d)\n \u2014\n Backlog\n \n \n\n DO-677\n need to implement a lifecycle policy for s3 buckets backups\n \u2014\n May 9, '25\n Feb 18, '26 (114d)\n \u2014\n Backlog\n \n \n\n \n\n IM \u2014 Incident Management\n 10 active issues\n \n \n\n KeySummaryAssignee\n CreatedLast updatedDue dateStatus\n \nStory 9\n \n\n IM-7708\n Rutherford, TN - Student Import Stuck at 0.0% during the Finding Service Status\n Vader\n Jul 21, '26\n Jul 28, '26\n \u2014\n WORK IN PROGRESS\n \n \n\n IM-7685\n Henrico, San Bernardino - WHERES MY CHILD button sends user to phone's Home Screen - iOS\n Brandon Donnelson\n Jul 8, '26\n Jul 28, '26\n \u2014\n Open Issue\n \n \n\n IM-7682\n Cobb - SAR Approval Problems\n Boluwatife Olaifa\n Jul 6, '26\n Jul 10, '26 (12d)\n \u2014\n Wait for Release\n \n \n\n IM-7680\n San Bernardino, CA - Getting network timeout errors when updating school locations \n Manuel Esquivel\n Jul 1, '26\n Jul 6, '26 (16d)\n \u2014\n WORK IN PROGRESS\n \n \n\n IM-7671\n PPF - Parents Cant Access Data with Different SAR Codes\n Boluwatife Olaifa\n Jun 26, '26\n Jul 28, '26\n \u2014\n Open Issue\n \n \n\n IM-7646\n Summer School Trips not Available\n Brandon Donnelson\n Jun 10, '26\n Jun 24, '26 (24d)\n \u2014\n Ready for UAT\n \n \n\n IM-7623\n PPF - Ride Registration Address Option not working- SM \n Boluwatife Olaifa\n May 28, '26\n Jun 23, '26 (25d)\n \u2014\n WORK IN PROGRESS\n \n \n\n IM-7548\n Cobb County, GA - Severely Degraded Athena Performance\n Brandon Donnelson\n Apr 29, '26\n Jun 5, '26 (37d)\n \u2014\n Open Issue\n \n \n\n IM-7547\n Rochambeau, MD - Busses 203/204 have not had movement in Parent Porta Lite since 7:30 PM on 4/27\n Vader\n Apr 29, '26\n Jun 23, '26 (25d)\n \u2014\n Open Issue\n \nTask 1\n \n\n IM-7707\n Cobb County, GA - Athena is Slow and Not Updating Data Properly\n Boluwatife Olaifa\n Jul 21, '26\n Jul 21, '26 (5d)\n \u2014\n WORK IN PROGRESS\n \n \n\n \n\n S2 \u2014 Soc-2 & Security\n 9 active issues\n \n \n\n KeySummaryAssignee\n CreatedLast updatedDue dateStatus\n \nTask 9\n \n\n S2-639\n [Incident Response] Opt-in Text Service\n Madison Irwin\n Feb 17, '26\n Mar 3, '26 (105d)\n Apr 30, '26\n Backlog\n \n \n\n S2-638\n Incident Response Communication Plan [Epic]\n Madison Irwin\n Feb 17, '26\n Feb 18, '26 (114d)\n Apr 30, '26\n Backlog\n \n \n\n S2-636\n Rotate Google API keys found in public repo\n Brandon Donnelson\n Feb 3, '26\n Feb 12, '26 (118d)\n \u2014\n IN PROGRESS\n \n \n\n S2-484\n Finalize Incident Response Decision Tree\n Madison Irwin\n Jan 22, '25\n Feb 18, '26 (114d)\n \u2014\n Backlog\n \n \n\n S2-482\n Security Incident Recovery Plan\n Bret Marquardt\n Jan 22, '25\n Mar 3, '26 (105d)\n Dec 9, '25\n Backlog\n \n \n\n S2-480\n List of Core/Critical Services\n Bret Marquardt\n Jan 22, '25\n Feb 18, '26 (114d)\n Dec 9, '25\n Backlog\n \n \n\n S2-479\n Disaster Recovery Flow Chart\n Bret Marquardt\n Jan 22, '25\n Mar 3, '26 (105d)\n Dec 9, '25\n Backlog\n \n \n\n S2-477\n Technical Outage Tabletop - Mini Tabletop Serires\n Madison Irwin\n Jan 22, '25\n Mar 3, '26 (105d)\n \u2014\n Backlog\n \n \n\n S2-462\n Vulnerability Remediation\n \u2014\n Jan 2, '25\n Feb 18, '26 (114d)\n \u2014\n Backlog\n \n\nData sourced live from Jira on July 28, 2026 at 04:33 PM.\n\nfunction showTab(key,el){\n document.querySelectorAll('.tab').forEach(t=>t.classList.remove('active'));\n el.classList.add('active');\n document.querySelectorAll('.pane').forEach(p=>p.style.display='none');\n document.getElementById('pane-'+key).style.display='block';\n}\n\n\n", "creation_timestamp": "2026-07-28T22:33:56.382810Z"}