{"uuid": "7e7d5490-339e-4368-9fcc-211c7ec9bc87", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-14847", "type": "seen", "source": "https://gist.github.com/ef-edulog/2f46c9745951a6b1957ce80e865405ae", "content": "\n\n\n\n\nJira Report \u2014 DO / IM / S2\n\n :root {\n --bg: #fff; --bg2: #f5f4ef; --bg3: #ebebeb;\n --tx: #1a1a1a; --tx2: #666660; --tx3: #999994;\n --info: #185FA5; --bdr: rgba(0,0,0,0.12); --bdr2: rgba(0,0,0,0.22);\n --r: 8px; --rl: 12px;\n --font: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;\n --mono: 'SF Mono','Fira Code',monospace;\n }\n @media(prefers-color-scheme:dark){\n :root{--bg:#1e1e1c;--bg2:#2a2a28;--bg3:#333330;--tx:#f0efe8;--tx2:#a8a79f;--tx3:#6e6e68;--info:#85B7EB;--bdr:rgba(255,255,255,0.1);--bdr2:rgba(255,255,255,0.18)}\n }\n *{box-sizing:border-box;margin:0;padding:0}\n body{font-family:var(--font);background:var(--bg);color:var(--tx);padding:24px;max-width:1300px;margin:0 auto}\n h1{font-size:18px;font-weight:500;margin-bottom:4px}\n .sub{font-size:12px;color:var(--tx2);margin-bottom:20px}\n .tabs{display:flex;gap:6px;margin-bottom:1.25rem;flex-wrap:wrap}\n .tab{padding:5px 13px;border:0.5px solid var(--bdr2);border-radius:var(--r);font-size:13px;cursor:pointer;background:var(--bg);color:var(--tx2)}\n .tab.active{background:var(--bg2);color:var(--tx);font-weight:500}\n .tab:hover:not(.active){background:var(--bg2)}\n .legend{display:flex;gap:14px;flex-wrap:wrap;margin-bottom:1rem;font-size:11px;color:var(--tx2);align-items:center}\n .li{display:flex;align-items:center;gap:4px}\n .ld{width:9px;height:9px;border-radius:2px}\n .summary-grid{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:8px;margin-bottom:1.25rem}\n .metric{background:var(--bg2);border-radius:var(--r);padding:10px 12px}\n .ml{font-size:11px;color:var(--tx2);margin-bottom:3px}\n .mv{font-size:20px;font-weight:500}\n .project-block{margin-bottom:1.1rem;border:0.5px solid var(--bdr);border-radius:var(--rl);overflow:hidden}\n .ph{padding:9px 14px;border-bottom:0.5px solid var(--bdr);display:flex;align-items:center;justify-content:space-between}\n .pn{font-size:13px;font-weight:500}\n .pm{font-size:11px;color:var(--tx2)}\n .th{padding:5px 14px;font-size:11px;font-weight:500;color:var(--tx2);background:var(--bg2);display:flex;align-items:center;gap:6px;border-top:0.5px solid var(--bdr)}\n .tc{background:var(--bg3);color:var(--tx2);padding:1px 6px;border-radius:var(--r);font-size:10px}\n .cols{display:grid;grid-template-columns:80px 1fr 86px 82px 82px 80px 98px;gap:4px;padding:4px 14px;font-size:10px;color:var(--tx3);background:var(--bg2);border-top:0.5px solid var(--bdr)}\n .ir{display:grid;grid-template-columns:80px 1fr 86px 82px 82px 80px 98px;gap:4px;padding:6px 14px;align-items:start;border-top:0.5px solid var(--bdr);font-size:11px}\n .ir.stale{background:rgba(250,238,218,0.3)}\n .ir.highest{background:rgba(252,235,235,0.35)}\n .ir.overdue{background:rgba(252,235,235,0.45)}\n .ir.stale.highest,.ir.stale.overdue{background:rgba(250,220,200,0.45)}\n @media(prefers-color-scheme:dark){\n .ir.stale{background:rgba(99,56,6,0.2)}.ir.highest{background:rgba(121,31,31,0.2)}\n .ir.overdue{background:rgba(121,31,31,0.3)}.ir.stale.highest,.ir.stale.overdue{background:rgba(110,40,6,0.28)}\n }\n .ik{color:var(--info);font-size:10px;font-family:var(--mono);white-space:nowrap;text-decoration:none}\n .ik:hover{text-decoration:underline}\n .is{color:var(--tx);line-height:1.4;overflow:hidden;display:-webkit-box;-webkit-line-clamp:2;-webkit-box-orient:vertical}\n .ia{color:var(--tx2);font-size:10px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}\n .dt{font-size:10px;white-space:nowrap}\n .upd-ok{color:var(--tx2)}.upd-stale{color:#BA7517;font-weight:500}\n .due-ok{color:var(--tx2)}.due-over{color:#A32D2D;font-weight:500}\n .cr{color:var(--tx2)}\n @media(prefers-color-scheme:dark){.upd-stale{color:#FAC775}.due-over{color:#F7C1C1}}\n .dot-h{display:inline-block;width:5px;height:5px;border-radius:50%;background:#E24B4A;margin-right:2px;vertical-align:middle}\n .dot-s{display:inline-block;width:5px;height:5px;border-radius:50%;background:#EF9F27;margin-right:2px;vertical-align:middle}\n .dot-d{display:inline-block;width:5px;height:5px;border-radius:50%;background:#D85A30;margin-right:2px;vertical-align:middle}\n .sb{font-size:10px;padding:2px 6px;border-radius:var(--r);text-align:center;white-space:nowrap}\n .s-ip{background:#FAEEDA;color:#854F0B}.s-td{background:#E1F5EE;color:#0F6E56}\n .s-oi{background:#FCEBEB;color:#A32D2D}.s-xx{background:var(--bg2);color:var(--tx2)}\n @media(prefers-color-scheme:dark){\n .s-ip{background:#633806;color:#FAC775}.s-td{background:#085041;color:#9FE1CB}.s-oi{background:#791F1F;color:#F7C1C1}\n }\n .empty{padding:16px;text-align:center;color:var(--tx3);font-size:12px}\n .footer{font-size:11px;color:var(--tx3);margin-top:24px}\n\n\n\n\nJira Active Issues Report \u2014 DO / IM / S2\n\nGenerated July 13, 2026 at 09:40 AM  \u00b7  Excludes Done, Fixed, Canceled, Deferred  \u00b7  https://karrostech.atlassian.net\n\nLast 24 hrs24\u201348 hrs ago2\u20137 days agoOlder than 7 days\n\n\n Highest priority\n Stale \u22655 business days\n Due date missed\n\n\n\n\n\nDO \u2014 Edulog DevOps\n1\n\nIM \u2014 Incident Management\n2\n\nS2 \u2014 Soc-2 & Security\n0\n \n\n \n\n DO \u2014 Edulog DevOps\n 1 active issue\n \n \n\n KeySummaryAssignee\n CreatedLast updatedDue dateStatus\n \nTask 1\n \n\n DO-2702\n Kansas City, KS - Please Set Up ASDI\n Cory Emlen\n Jul 13, '26\n Jul 13, '26\n \u2014\n Backlog\n \n \n\n \n\n IM \u2014 Incident Management\n 2 active issues\n \n \n\n KeySummaryAssignee\n CreatedLast updatedDue dateStatus\n \nStory 1\n \n\n IM-7688\n COBB GA - SM can't find student credentials \n Vader\n Jul 13, '26\n Jul 13, '26\n \u2014\n WORK IN PROGRESS\n \nTask 1\n \n\n IM-7689\n Cleveland, OH - Unable to Replace Plan with their nextyear Sandbox\n Eric Fischl\n Jul 13, '26\n Jul 13, '26\n \u2014\n Open Issue\n \n\n\n\nDO \u2014 Edulog DevOps\n0\n\nIM \u2014 Incident Management\n0\n\nS2 \u2014 Soc-2 & Security\n0\n\n\n\nDO \u2014 Edulog DevOps\n5\n\nIM \u2014 Incident Management\n3\n\nS2 \u2014 Soc-2 & Security\n0\n \n\n \n\n DO \u2014 Edulog DevOps\n 5 active issues\n \n \n\n KeySummaryAssignee\n CreatedLast updatedDue dateStatus\n \nBug 1\n \n\n DO-2689\n Athena V2 backend ignores per-tenant dbssl -> sales-demo /v2/dispatcher (+Vehicles/Drivers/Locations) 500; RDS rejects 'no pg_hba.conf entry ... no encryption'\n Chukwuemeka Chukwurah\n Jul 9, '26\n Jul 13, '26\n \u2014\n Backlog\n \nStory 2\n \n\n DO-2692\n San Bernardino, CA - Please update Sy2627 talend script \n Cory Emlen\n Jul 9, '26\n Jul 10, '26\n \u2014\n Verification\n \n \n\n DO-2674\n FFCA, AB - Changes to Talend script\n Cory Emlen\n Jul 7, '26\n Jul 9, '26\n \u2014\n Verification\n \nTask 2\n \n\n DO-2697\n Princeton, NJ - adjust talend - school code translation\n Cory Emlen\n Jul 10, '26\n Jul 13, '26\n \u2014\n IN PROGRESS\n \n \n\n DO-2680\n Cobb County, GA - Update ASDI to Protect SPED, BRDG, CAMP, and UNIV Students\n Cory Emlen\n Jul 8, '26\n Jul 9, '26\n \u2014\n IN PROGRESS\n \n \n\n \n\n IM \u2014 Incident Management\n 3 active issues\n \n \n\n KeySummaryAssignee\n CreatedLast updatedDue dateStatus\n \nStory 3\n \n\n IM-7687\n Kalispell, MT - Walk Boundary Calculation Fails\n Vader\n Jul 10, '26\n Jul 10, '26\n \u2014\n WORK IN PROGRESS\n \n \n\n IM-7685\n WHERES MY CHILD button sends user to phone's Home Screen - iOS\n Brandon Donnelson\n Jul 8, '26\n Jul 10, '26\n \u2014\n Open Issue\n \n \n\n IM-7682\n Cobb - SAR Approval Problems\n Boluwatife Olaifa\n Jul 6, '26\n Jul 10, '26\n \u2014\n Wait for Release\n \n\n\n\nDO \u2014 Edulog DevOps\n28\n\nIM \u2014 Incident Management\n11\n\nS2 \u2014 Soc-2 & Security\n11\n \n\n \n\n DO \u2014 Edulog DevOps\n 28 active issues\n \n \n\n KeySummaryAssignee\n CreatedLast updatedDue dateStatus\n \nATH New site request 2\n \n\n DO-2229\n Hillsborough, FL - Athena Conversion from Legacy\n JD Holwick\n Jun 9, '26\n Jul 13, '26\n Jun 26, '26\n IN PROGRESS\n \n \n\n DO-1787\n Elyria, OH - Athena Conversion from Legacy\n Cory Emlen\n Mar 17, '26\n Apr 30, '26 (52d)\n Apr 17, '26\n Blocked\n \nBug 2\n \n\n DO-1786\n [EastAllen, IN 1.78 Smoke]CA Result CSV \u2013 Export fails for valid dates with 400 Bad Request (invalid page number)\n Dane Elwood\n Mar 17, '26\n Mar 26, '26 (77d)\n \u2014\n Blocked\n \n \n\n DO-1512\n 500 Internal Server Err on Search API [UAT01/1.78]\n Vader\n Feb 27, '26\n May 29, '26 (31d)\n \u2014\n To Do\n \nStory 4\n \n\n DO-2380\n Aldine, TX - Please run Talend script\n Amy Madzelonka\n Jun 18, '26\n Jun 24, '26 (13d)\n \u2014\n Verification\n \n \n\n DO-2235\n San Bernardino, CA - SY2627 Data Area - delete stops \n Nathan Bible\n Jun 9, '26\n Jun 12, '26 (21d)\n \u2014\n Backlog\n \n \n\n DO-2025\n Birdville, TX - Please deploy Telematics\n Cory Emlen\n Apr 29, '26\n Jun 29, '26 (10d)\n \u2014\n Verification\n \n \n\n DO-1112\n Lake Superior, MN Clone - Map Work Package\n David Goldberg\n Nov 20, '25\n Mar 9, '26 (90d)\n \u2014\n IN PROGRESS\n \nTask 20\n \n\n DO-2628\n Superior, WI - Please set up S3/SFTP Reports Folder\n JD Hawk\n Jun 30, '26\n Jul 13, '26\n \u2014\n Backlog\n \n \n\n DO-2627\n Glendale, AZ - Please set up S3/SFTP Reports Folder\n JD Hawk\n Jun 30, '26\n Jul 13, '26\n \u2014\n Backlog\n \n \n\n DO-2626\n Kansas City, KS - Please set up S3/SFTP Reports Folder\n JD Hawk\n Jun 30, '26\n Jul 13, '26\n \u2014\n Backlog\n \n \n\n DO-2478\n Cobb County, GA - Missing Vehicles after Sandbox Replacement\n Mbaoma Mary\n Jun 26, '26\n Jun 29, '26 (10d)\n \u2014\n Verification\n \n \n\n DO-2473\n AV2 parent SMS (SNS): wire +18667248105 as default origination, exit sandbox, IAM/IaC on AthenaV2SecretGetter\n \u2014\n Jun 25, '26\n Jun 29, '26 (10d)\n \u2014\n Backlog\n \n \n\n DO-2446\n Kansas City, KS - Athena/Parent Portal Integration\n Vader\n Jun 24, '26\n Jul 6, '26 (5d)\n Jul 1, '26\n Verification\n \n \n\n DO-2395\n New Berlin, WI - Please Set Up ASDI\n Cory Emlen\n Jun 19, '26\n Jul 9, '26\n \u2014\n Verification\n \n \n\n DO-2364\n Shared School Services - Set up GTS integration\n Kehinde Metibemu\n Jun 16, '26\n Jun 22, '26 (15d)\n Jun 18, '26\n Backlog\n \n \n\n DO-2351\n Superior, WI - Please Deploy Web Query\n JD Holwick\n Jun 12, '26\n Jun 30, '26 (9d)\n \u2014\n Backlog\n \n \n\n DO-2245\n Newport News, VA - Athena SSO\n Vader\n Jun 10, '26\n Jun 10, '26 (23d)\n \u2014\n IN PROGRESS\n \n \n\n DO-2218\n Johnston, NC - Clone - Stop Checking\n Dan McGuire\n Jun 8, '26\n Jun 10, '26 (23d)\n \u2014\n Backlog\n \n \n\n DO-2101\n Add workforce.edulog.com hosts to Keycloak `driver-portal` client Web Origins + Valid Redirect URIs (3 realms)\n Brandon Donnelson\n May 18, '26\n May 18, '26 (40d)\n \u2014\n IN PROGRESS\n \n \n\n DO-2099\n Add 6 Namecheap CNAMEs for workforce.edulog.com (DP V2 web SPA) + update 3 CloudFront distros with alias + ACM cert\n Brandon Donnelson\n May 18, '26\n May 18, '26 (40d)\n \u2014\n IN PROGRESS\n \n \n\n DO-2006\n Remove non-active Tenants from Grafana Plan Ingestion Global Audit\n JD Hawk\n Aug 25, '25\n Jun 22, '26 (15d)\n \u2014\n To Do\n \n \n\n DO-1810\n Brevard-FL - Update Tenant Reports \"Bulletin Bus Run\" \n Manuel Esquivel\n Mar 20, '26\n Jun 24, '26 (13d)\n \u2014\n Backlog\n \n \n\n DO-1748\n San Bernardino, CA - Scan History is showing the wrong time\n Brandon Donnelson\n Mar 11, '26\n Jul 8, '26\n \u2014\n IN PROGRESS\n \n \n\n DO-1158\n Patch CVE-2025-14847 for Mongo Services running 8.0.4\n Vader\n Dec 24, '25\n Jul 6, '26 (5d)\n \u2014\n On hold\n \n \n\n DO-1125\n Update Crush SG/NACL to not allow internet traffic and restrict to the AWS VPN\n Josiah Brown\n Dec 3, '25\n Feb 18, '26 (103d)\n \u2014\n Backlog\n \n \n\n DO-1013\n Move all athena-legacy EC2 Instances to have Encrypted EBS Volumes\n Vader\n Oct 29, '25\n Jun 30, '26 (9d)\n \u2014\n Backlog\n \n \n\n DO-677\n need to implement a lifecycle policy for s3 buckets backups\n \u2014\n May 9, '25\n Feb 18, '26 (103d)\n \u2014\n Backlog\n \n \n\n \n\n IM \u2014 Incident Management\n 11 active issues\n \n \n\n KeySummaryAssignee\n CreatedLast updatedDue dateStatus\n \nStory 10\n \n\n IM-7681\n PEORIA and Kansas City Kansas - CLONE - Cobb - PPF not reading the Custom Message set in SM\n Boluwatife Olaifa\n Jul 3, '26\n Jul 9, '26\n \u2014\n Open Issue\n \n \n\n IM-7680\n San Bernardino, CA - Getting network timeout errors when updating school locations \n Manuel Esquivel\n Jul 1, '26\n Jul 6, '26 (5d)\n \u2014\n WORK IN PROGRESS\n \n \n\n IM-7671\n PPF - Parents Cant Access Data with Different SAR Codes\n Boluwatife Olaifa\n Jun 26, '26\n Jul 8, '26\n \u2014\n Open Issue\n \n \n\n IM-7646\n Summer School Trips not Available\n Brandon Donnelson\n Jun 10, '26\n Jun 24, '26 (13d)\n \u2014\n Ready for UAT\n \n \n\n IM-7623\n PPF - Ride Registration Address Option not working- SM \n Boluwatife Olaifa\n May 28, '26\n Jun 23, '26 (14d)\n \u2014\n WORK IN PROGRESS\n \n \n\n IM-7548\n Cobb County, GA - Severely Degraded Athena Performance\n Brandon Donnelson\n Apr 29, '26\n Jun 5, '26 (26d)\n \u2014\n Open Issue\n \n \n\n IM-7547\n Rochambeau, MD - Busses 203/204 have not had movement in Parent Porta Lite since 7:30 PM on 4/27\n Vader\n Apr 29, '26\n Jun 23, '26 (14d)\n \u2014\n Open Issue\n \n \n\n IM-7514\n San Bernardino, CA - Telematics > On time performance reports show no data \n Vader\n Apr 10, '26\n Jun 23, '26 (14d)\n \u2014\n Open Issue\n \n \n\n IM-6566\n Duncanville, TX - Boundaries Need to Be Restored or Reimported Based on a Backup\n \u2014\n Mar 25, '25\n May 27, '26 (33d)\n \u2014\n Wait for Release\n \n \n\n IM-5774\n Driver Portal - Tomcat version\n \u2014\n May 21, '24\n Jun 3, '26 (28d)\n \u2014\n Wait for Release\n \nTask 1\n \n\n IM-7643\n Chicago SSO Authentication Issue for Vendors\n Eric Fischl\n Jun 9, '26\n Jul 8, '26\n \u2014\n Open Issue\n \n \n\n \n\n S2 \u2014 Soc-2 & Security\n 11 active issues\n \n \n\n KeySummaryAssignee\n CreatedLast updatedDue dateStatus\n \nTask 11\n \n\n S2-639\n [Incident Response] Opt-in Text Service\n Madison Irwin\n Feb 17, '26\n Mar 3, '26 (94d)\n Apr 30, '26\n Backlog\n \n \n\n S2-638\n Incident Response Communication Plan [Epic]\n Madison Irwin\n Feb 17, '26\n Feb 18, '26 (103d)\n Apr 30, '26\n Backlog\n \n \n\n S2-636\n Rotate Google API keys found in public repo\n Brandon Donnelson\n Feb 3, '26\n Feb 12, '26 (107d)\n \u2014\n IN PROGRESS\n \n \n\n S2-484\n Finalize Incident Response Decision Tree\n Madison Irwin\n Jan 22, '25\n Feb 18, '26 (103d)\n \u2014\n Backlog\n \n \n\n S2-482\n Security Incident Recovery Plan\n Bret Marquardt\n Jan 22, '25\n Mar 3, '26 (94d)\n Dec 9, '25\n Backlog\n \n \n\n S2-480\n List of Core/Critical Services\n Bret Marquardt\n Jan 22, '25\n Feb 18, '26 (103d)\n Dec 9, '25\n Backlog\n \n \n\n S2-479\n Disaster Recovery Flow Chart\n Bret Marquardt\n Jan 22, '25\n Mar 3, '26 (94d)\n Dec 9, '25\n Backlog\n \n \n\n S2-477\n Technical Outage Tabletop - Mini Tabletop Serires\n Madison Irwin\n Jan 22, '25\n Mar 3, '26 (94d)\n \u2014\n Backlog\n \n \n\n S2-462\n Vulnerability Remediation\n \u2014\n Jan 2, '25\n Feb 18, '26 (103d)\n \u2014\n Backlog\n \n \n\n S2-460\n Patching Hygiene Practicies and Documentation\n \u2014\n Jan 2, '25\n Feb 18, '26 (103d)\n \u2014\n Backlog\n \n \n\n S2-229\n Modify JSON API that only draws the information we need for parent portal\n \u2014\n Jul 11, '23\n Feb 18, '26 (103d)\n \u2014\n Backlog\n \n\nData sourced live from Jira on July 13, 2026 at 09:40 AM.\n\nfunction showTab(key,el){\n document.querySelectorAll('.tab').forEach(t=>t.classList.remove('active'));\n el.classList.add('active');\n document.querySelectorAll('.pane').forEach(p=>p.style.display='none');\n document.getElementById('pane-'+key).style.display='block';\n}\n\n\n", "creation_timestamp": "2026-07-13T15:41:02.765809Z"}