{"uuid": "64802d2c-781e-4804-b91f-dca31bf6feb4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-14847", "type": "seen", "source": "https://gist.github.com/ef-edulog/761ffcb7102e9e0ae2f2bb895fdefe7c", "content": "\n\n\n\n\nJira Report \u2014 DO / IM / S2\n\n :root {\n --bg: #fff; --bg2: #f5f4ef; --bg3: #ebebeb;\n --tx: #1a1a1a; --tx2: #666660; --tx3: #999994;\n --info: #185FA5; --bdr: rgba(0,0,0,0.12); --bdr2: rgba(0,0,0,0.22);\n --r: 8px; --rl: 12px;\n --font: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;\n --mono: 'SF Mono','Fira Code',monospace;\n }\n @media(prefers-color-scheme:dark){\n :root{--bg:#1e1e1c;--bg2:#2a2a28;--bg3:#333330;--tx:#f0efe8;--tx2:#a8a79f;--tx3:#6e6e68;--info:#85B7EB;--bdr:rgba(255,255,255,0.1);--bdr2:rgba(255,255,255,0.18)}\n }\n *{box-sizing:border-box;margin:0;padding:0}\n body{font-family:var(--font);background:var(--bg);color:var(--tx);padding:24px;max-width:1300px;margin:0 auto}\n h1{font-size:18px;font-weight:500;margin-bottom:4px}\n .sub{font-size:12px;color:var(--tx2);margin-bottom:20px}\n .tabs{display:flex;gap:6px;margin-bottom:1.25rem;flex-wrap:wrap}\n .tab{padding:5px 13px;border:0.5px solid var(--bdr2);border-radius:var(--r);font-size:13px;cursor:pointer;background:var(--bg);color:var(--tx2)}\n .tab.active{background:var(--bg2);color:var(--tx);font-weight:500}\n .tab:hover:not(.active){background:var(--bg2)}\n .legend{display:flex;gap:14px;flex-wrap:wrap;margin-bottom:1rem;font-size:11px;color:var(--tx2);align-items:center}\n .li{display:flex;align-items:center;gap:4px}\n .ld{width:9px;height:9px;border-radius:2px}\n .summary-grid{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:8px;margin-bottom:1.25rem}\n .metric{background:var(--bg2);border-radius:var(--r);padding:10px 12px}\n .ml{font-size:11px;color:var(--tx2);margin-bottom:3px}\n .mv{font-size:20px;font-weight:500}\n .project-block{margin-bottom:1.1rem;border:0.5px solid var(--bdr);border-radius:var(--rl);overflow:hidden}\n .ph{padding:9px 14px;border-bottom:0.5px solid var(--bdr);display:flex;align-items:center;justify-content:space-between}\n .pn{font-size:13px;font-weight:500}\n .pm{font-size:11px;color:var(--tx2)}\n .th{padding:5px 14px;font-size:11px;font-weight:500;color:var(--tx2);background:var(--bg2);display:flex;align-items:center;gap:6px;border-top:0.5px solid var(--bdr)}\n .tc{background:var(--bg3);color:var(--tx2);padding:1px 6px;border-radius:var(--r);font-size:10px}\n .cols{display:grid;grid-template-columns:80px 1fr 86px 82px 82px 80px 98px;gap:4px;padding:4px 14px;font-size:10px;color:var(--tx3);background:var(--bg2);border-top:0.5px solid var(--bdr)}\n .ir{display:grid;grid-template-columns:80px 1fr 86px 82px 82px 80px 98px;gap:4px;padding:6px 14px;align-items:start;border-top:0.5px solid var(--bdr);font-size:11px}\n .ir.stale{background:rgba(250,238,218,0.3)}\n .ir.highest{background:rgba(252,235,235,0.35)}\n .ir.overdue{background:rgba(252,235,235,0.45)}\n .ir.stale.highest,.ir.stale.overdue{background:rgba(250,220,200,0.45)}\n @media(prefers-color-scheme:dark){\n .ir.stale{background:rgba(99,56,6,0.2)}.ir.highest{background:rgba(121,31,31,0.2)}\n .ir.overdue{background:rgba(121,31,31,0.3)}.ir.stale.highest,.ir.stale.overdue{background:rgba(110,40,6,0.28)}\n }\n .ik{color:var(--info);font-size:10px;font-family:var(--mono);white-space:nowrap;text-decoration:none}\n .ik:hover{text-decoration:underline}\n .is{color:var(--tx);line-height:1.4;overflow:hidden;display:-webkit-box;-webkit-line-clamp:2;-webkit-box-orient:vertical}\n .ia{color:var(--tx2);font-size:10px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}\n .dt{font-size:10px;white-space:nowrap}\n .upd-ok{color:var(--tx2)}.upd-stale{color:#BA7517;font-weight:500}\n .due-ok{color:var(--tx2)}.due-over{color:#A32D2D;font-weight:500}\n .cr{color:var(--tx2)}\n @media(prefers-color-scheme:dark){.upd-stale{color:#FAC775}.due-over{color:#F7C1C1}}\n .dot-h{display:inline-block;width:5px;height:5px;border-radius:50%;background:#E24B4A;margin-right:2px;vertical-align:middle}\n .dot-s{display:inline-block;width:5px;height:5px;border-radius:50%;background:#EF9F27;margin-right:2px;vertical-align:middle}\n .dot-d{display:inline-block;width:5px;height:5px;border-radius:50%;background:#D85A30;margin-right:2px;vertical-align:middle}\n .sb{font-size:10px;padding:2px 6px;border-radius:var(--r);text-align:center;white-space:nowrap}\n .s-ip{background:#FAEEDA;color:#854F0B}.s-td{background:#E1F5EE;color:#0F6E56}\n .s-oi{background:#FCEBEB;color:#A32D2D}.s-xx{background:var(--bg2);color:var(--tx2)}\n @media(prefers-color-scheme:dark){\n .s-ip{background:#633806;color:#FAC775}.s-td{background:#085041;color:#9FE1CB}.s-oi{background:#791F1F;color:#F7C1C1}\n }\n .empty{padding:16px;text-align:center;color:var(--tx3);font-size:12px}\n .footer{font-size:11px;color:var(--tx3);margin-top:24px}\n\n\n\n\nJira Active Issues Report \u2014 DO / IM / S2\n\nGenerated July 14, 2026 at 04:28 PM  \u00b7  Excludes Done, Fixed, Canceled, Deferred  \u00b7  https://karrostech.atlassian.net\n\nLast 24 hrs24\u201348 hrs ago2\u20137 days agoOlder than 7 days\n\n\n Highest priority\n Stale \u22655 business days\n Due date missed\n\n\n\n\n\nDO \u2014 Edulog DevOps\n2\n\nIM \u2014 Incident Management\n0\n\nS2 \u2014 Soc-2 & Security\n0\n \n\n \n\n DO \u2014 Edulog DevOps\n 2 active issues\n \n \n\n KeySummaryAssignee\n CreatedLast updatedDue dateStatus\n \nTask 2\n \n\n DO-2715\n Providence, RI - Talend update - home stop, transportation needs, no riders \n Cory Emlen\n Jul 14, '26\n Jul 14, '26\n \u2014\n IN PROGRESS\n \n \n\n DO-2714\n Houston County, GA - Changes to Talend script\n Cory Emlen\n Jul 14, '26\n Jul 14, '26\n \u2014\n IN PROGRESS\n \n\n\n\nDO \u2014 Edulog DevOps\n4\n\nIM \u2014 Incident Management\n0\n\nS2 \u2014 Soc-2 & Security\n0\n \n\n \n\n DO \u2014 Edulog DevOps\n 4 active issues\n \n \n\n KeySummaryAssignee\n CreatedLast updatedDue dateStatus\n \nStory 1\n \n\n DO-2711\n FFCA, AB - Changes to Talend script\n Cory Emlen\n Jul 13, '26\n Jul 14, '26\n \u2014\n Backlog\n \nTask 3\n \n\n DO-2709\n sales-demo nonprod: Sara Corbally No Access after login (no features enabled)\n MacBobby Chibuzor\n Jul 13, '26\n Jul 14, '26\n \u2014\n Backlog\n \n \n\n DO-2707\n White Bear Lake, MN - Please update ASDI to run into 2026work Sandbox\n Cory Emlen\n Jul 13, '26\n Jul 14, '26\n \u2014\n Verification\n \n \n\n DO-2702\n Kansas City, KS - Please Set Up ASDI\n Cory Emlen\n Jul 13, '26\n Jul 13, '26\n \u2014\n Backlog\n \n\n\n\nDO \u2014 Edulog DevOps\n2\n\nIM \u2014 Incident Management\n1\n\nS2 \u2014 Soc-2 & Security\n0\n \n\n \n\n DO \u2014 Edulog DevOps\n 2 active issues\n \n \n\n KeySummaryAssignee\n CreatedLast updatedDue dateStatus\n \nBug 1\n \n\n DO-2689\n Athena V2 backend ignores per-tenant dbssl -> sales-demo /v2/dispatcher (+Vehicles/Drivers/Locations) 500; RDS rejects 'no pg_hba.conf entry ... no encryption'\n MacBobby Chibuzor\n Jul 9, '26\n Jul 14, '26\n \u2014\n To Do\n \nTask 1\n \n\n DO-2697\n Princeton, NJ - adjust talend - school code translation\n Cory Emlen\n Jul 10, '26\n Jul 14, '26\n \u2014\n Verification\n \n \n\n \n\n IM \u2014 Incident Management\n 1 active issue\n \n \n\n KeySummaryAssignee\n CreatedLast updatedDue dateStatus\n \nStory 1\n \n\n IM-7685\n WHERES MY CHILD button sends user to phone's Home Screen - iOS\n Brandon Donnelson\n Jul 8, '26\n Jul 10, '26\n \u2014\n Open Issue\n \n\n\n\nDO \u2014 Edulog DevOps\n25\n\nIM \u2014 Incident Management\n8\n\nS2 \u2014 Soc-2 & Security\n12\n \n\n \n\n DO \u2014 Edulog DevOps\n 25 active issues\n \n \n\n KeySummaryAssignee\n CreatedLast updatedDue dateStatus\n \nATH New site request 2\n \n\n DO-2229\n Hillsborough, FL - Athena Conversion from Legacy\n JD Holwick\n Jun 9, '26\n Jul 13, '26\n Jun 26, '26\n IN PROGRESS\n \n \n\n DO-1787\n Elyria, OH - Athena Conversion from Legacy\n Cory Emlen\n Mar 17, '26\n Apr 30, '26 (53d)\n Apr 17, '26\n Blocked\n \nBug 2\n \n\n DO-1786\n [EastAllen, IN 1.78 Smoke]CA Result CSV \u2013 Export fails for valid dates with 400 Bad Request (invalid page number)\n Dane Elwood\n Mar 17, '26\n Mar 26, '26 (78d)\n \u2014\n Blocked\n \n \n\n DO-1512\n 500 Internal Server Err on Search API [UAT01/1.78]\n Vader\n Feb 27, '26\n May 29, '26 (32d)\n \u2014\n To Do\n \nStory 2\n \n\n DO-2235\n San Bernardino, CA - SY2627 Data Area - delete stops \n Nathan Bible\n Jun 9, '26\n Jun 12, '26 (22d)\n \u2014\n Backlog\n \n \n\n DO-1112\n Lake Superior, MN Clone - Map Work Package\n David Goldberg\n Nov 20, '25\n Mar 9, '26 (91d)\n \u2014\n IN PROGRESS\n \nTask 19\n \n\n DO-2628\n Superior, WI - Please set up S3/SFTP Reports Folder\n JD Hawk\n Jun 30, '26\n Jul 13, '26\n \u2014\n Backlog\n \n \n\n DO-2627\n Glendale, AZ - Please set up S3/SFTP Reports Folder\n JD Hawk\n Jun 30, '26\n Jul 13, '26\n \u2014\n Backlog\n \n \n\n DO-2626\n Kansas City, KS - Please set up S3/SFTP Reports Folder\n JD Hawk\n Jun 30, '26\n Jul 13, '26\n \u2014\n Backlog\n \n \n\n DO-2473\n AV2 parent SMS (SNS): wire +18667248105 as default origination, exit sandbox, IAM/IaC on AthenaV2SecretGetter\n \u2014\n Jun 25, '26\n Jun 29, '26 (11d)\n \u2014\n Backlog\n \n \n\n DO-2446\n Kansas City, KS - Athena/Parent Portal Integration\n Vader\n Jun 24, '26\n Jul 6, '26 (6d)\n Jul 1, '26\n Verification\n \n \n\n DO-2395\n New Berlin, WI - Please Set Up ASDI\n Cory Emlen\n Jun 19, '26\n Jul 9, '26\n \u2014\n Verification\n \n \n\n DO-2364\n Shared School Services - Set up GTS integration\n Kehinde Metibemu\n Jun 16, '26\n Jun 22, '26 (16d)\n Jun 18, '26\n Backlog\n \n \n\n DO-2351\n Superior, WI - Please Deploy Web Query\n JD Holwick\n Jun 12, '26\n Jun 30, '26 (10d)\n \u2014\n Backlog\n \n \n\n DO-2245\n Newport News, VA - Athena SSO\n Vader\n Jun 10, '26\n Jun 10, '26 (24d)\n \u2014\n IN PROGRESS\n \n \n\n DO-2218\n Johnston, NC - Clone - Stop Checking\n Dan McGuire\n Jun 8, '26\n Jun 10, '26 (24d)\n \u2014\n Backlog\n \n \n\n DO-2101\n Add workforce.edulog.com hosts to Keycloak `driver-portal` client Web Origins + Valid Redirect URIs (3 realms)\n Brandon Donnelson\n May 18, '26\n May 18, '26 (41d)\n \u2014\n IN PROGRESS\n \n \n\n DO-2099\n Add 6 Namecheap CNAMEs for workforce.edulog.com (DP V2 web SPA) + update 3 CloudFront distros with alias + ACM cert\n Brandon Donnelson\n May 18, '26\n May 18, '26 (41d)\n \u2014\n IN PROGRESS\n \n \n\n DO-2006\n Remove non-active Tenants from Grafana Plan Ingestion Global Audit\n JD Hawk\n Aug 25, '25\n Jun 22, '26 (16d)\n \u2014\n To Do\n \n \n\n DO-1810\n Brevard-FL - Update Tenant Reports \"Bulletin Bus Run\" \n Manuel Esquivel\n Mar 20, '26\n Jun 24, '26 (14d)\n \u2014\n Backlog\n \n \n\n DO-1748\n San Bernardino, CA - Scan History is showing the wrong time\n Brandon Donnelson\n Mar 11, '26\n Jul 8, '26\n \u2014\n IN PROGRESS\n \n \n\n DO-1158\n Patch CVE-2025-14847 for Mongo Services running 8.0.4\n Vader\n Dec 24, '25\n Jul 6, '26 (6d)\n \u2014\n On hold\n \n \n\n DO-1125\n Update Crush SG/NACL to not allow internet traffic and restrict to the AWS VPN\n Josiah Brown\n Dec 3, '25\n Feb 18, '26 (104d)\n \u2014\n Backlog\n \n \n\n DO-1013\n Move all athena-legacy EC2 Instances to have Encrypted EBS Volumes\n Vader\n Oct 29, '25\n Jun 30, '26 (10d)\n \u2014\n Backlog\n \n \n\n DO-677\n need to implement a lifecycle policy for s3 buckets backups\n \u2014\n May 9, '25\n Feb 18, '26 (104d)\n \u2014\n Backlog\n \n \n\n \n\n IM \u2014 Incident Management\n 8 active issues\n \n \n\n KeySummaryAssignee\n CreatedLast updatedDue dateStatus\n \nStory 8\n \n\n IM-7682\n Cobb - SAR Approval Problems\n Boluwatife Olaifa\n Jul 6, '26\n Jul 10, '26\n \u2014\n Wait for Release\n \n \n\n IM-7681\n PEORIA and Kansas City Kansas - CLONE - Cobb - PPF not reading the Custom Message set in SM\n Boluwatife Olaifa\n Jul 3, '26\n Jul 9, '26\n \u2014\n Open Issue\n \n \n\n IM-7680\n San Bernardino, CA - Getting network timeout errors when updating school locations \n Manuel Esquivel\n Jul 1, '26\n Jul 6, '26 (6d)\n \u2014\n WORK IN PROGRESS\n \n \n\n IM-7671\n PPF - Parents Cant Access Data with Different SAR Codes\n Boluwatife Olaifa\n Jun 26, '26\n Jul 14, '26\n \u2014\n Open Issue\n \n \n\n IM-7646\n Summer School Trips not Available\n Brandon Donnelson\n Jun 10, '26\n Jun 24, '26 (14d)\n \u2014\n Ready for UAT\n \n \n\n IM-7623\n PPF - Ride Registration Address Option not working- SM \n Boluwatife Olaifa\n May 28, '26\n Jun 23, '26 (15d)\n \u2014\n WORK IN PROGRESS\n \n \n\n IM-7548\n Cobb County, GA - Severely Degraded Athena Performance\n Brandon Donnelson\n Apr 29, '26\n Jun 5, '26 (27d)\n \u2014\n Open Issue\n \n \n\n IM-7547\n Rochambeau, MD - Busses 203/204 have not had movement in Parent Porta Lite since 7:30 PM on 4/27\n Vader\n Apr 29, '26\n Jun 23, '26 (15d)\n \u2014\n Open Issue\n \n \n\n \n\n S2 \u2014 Soc-2 & Security\n 12 active issues\n \n \n\n KeySummaryAssignee\n CreatedLast updatedDue dateStatus\n \nTask 12\n \n\n S2-639\n [Incident Response] Opt-in Text Service\n Madison Irwin\n Feb 17, '26\n Mar 3, '26 (95d)\n Apr 30, '26\n Backlog\n \n \n\n S2-638\n Incident Response Communication Plan [Epic]\n Madison Irwin\n Feb 17, '26\n Feb 18, '26 (104d)\n Apr 30, '26\n Backlog\n \n \n\n S2-636\n Rotate Google API keys found in public repo\n Brandon Donnelson\n Feb 3, '26\n Feb 12, '26 (108d)\n \u2014\n IN PROGRESS\n \n \n\n S2-484\n Finalize Incident Response Decision Tree\n Madison Irwin\n Jan 22, '25\n Feb 18, '26 (104d)\n \u2014\n Backlog\n \n \n\n S2-482\n Security Incident Recovery Plan\n Bret Marquardt\n Jan 22, '25\n Mar 3, '26 (95d)\n Dec 9, '25\n Backlog\n \n \n\n S2-480\n List of Core/Critical Services\n Bret Marquardt\n Jan 22, '25\n Feb 18, '26 (104d)\n Dec 9, '25\n Backlog\n \n \n\n S2-479\n Disaster Recovery Flow Chart\n Bret Marquardt\n Jan 22, '25\n Mar 3, '26 (95d)\n Dec 9, '25\n Backlog\n \n \n\n S2-477\n Technical Outage Tabletop - Mini Tabletop Serires\n Madison Irwin\n Jan 22, '25\n Mar 3, '26 (95d)\n \u2014\n Backlog\n \n \n\n S2-462\n Vulnerability Remediation\n \u2014\n Jan 2, '25\n Feb 18, '26 (104d)\n \u2014\n Backlog\n \n \n\n S2-460\n Patching Hygiene Practicies and Documentation\n \u2014\n Jan 2, '25\n Feb 18, '26 (104d)\n \u2014\n Backlog\n \n \n\n S2-229\n Modify JSON API that only draws the information we need for parent portal\n \u2014\n Jul 11, '23\n Feb 18, '26 (104d)\n \u2014\n Backlog\n \n \n\n S2-204\n Security issues found with web query.\n \u2014\n Feb 7, '24\n Mar 5, '26 (93d)\n \u2014\n Backlog\n \n\nData sourced live from Jira on July 14, 2026 at 04:28 PM.\n\nfunction showTab(key,el){\n document.querySelectorAll('.tab').forEach(t=>t.classList.remove('active'));\n el.classList.add('active');\n document.querySelectorAll('.pane').forEach(p=>p.style.display='none');\n document.getElementById('pane-'+key).style.display='block';\n}\n\n\n", "creation_timestamp": "2026-07-14T22:29:55.754930Z"}