{"uuid": "d6a03cc9-d0ae-47c7-a511-381956452140", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-14847", "type": "seen", "source": "https://gist.github.com/ef-edulog/4750eb28cbaf5d7ec87d193015657834", "content": "\n\n\n\n\nJira Report \u2014 DO / IM / S2\n\n :root {\n --bg: #fff; --bg2: #f5f4ef; --bg3: #ebebeb;\n --tx: #1a1a1a; --tx2: #666660; --tx3: #999994;\n --info: #185FA5; --bdr: rgba(0,0,0,0.12); --bdr2: rgba(0,0,0,0.22);\n --r: 8px; --rl: 12px;\n --font: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;\n --mono: 'SF Mono','Fira Code',monospace;\n }\n @media(prefers-color-scheme:dark){\n :root{--bg:#1e1e1c;--bg2:#2a2a28;--bg3:#333330;--tx:#f0efe8;--tx2:#a8a79f;--tx3:#6e6e68;--info:#85B7EB;--bdr:rgba(255,255,255,0.1);--bdr2:rgba(255,255,255,0.18)}\n }\n *{box-sizing:border-box;margin:0;padding:0}\n body{font-family:var(--font);background:var(--bg);color:var(--tx);padding:24px;max-width:1300px;margin:0 auto}\n h1{font-size:18px;font-weight:500;margin-bottom:4px}\n .sub{font-size:12px;color:var(--tx2);margin-bottom:20px}\n .tabs{display:flex;gap:6px;margin-bottom:1.25rem;flex-wrap:wrap}\n .tab{padding:5px 13px;border:0.5px solid var(--bdr2);border-radius:var(--r);font-size:13px;cursor:pointer;background:var(--bg);color:var(--tx2)}\n .tab.active{background:var(--bg2);color:var(--tx);font-weight:500}\n .tab:hover:not(.active){background:var(--bg2)}\n .legend{display:flex;gap:14px;flex-wrap:wrap;margin-bottom:1rem;font-size:11px;color:var(--tx2);align-items:center}\n .li{display:flex;align-items:center;gap:4px}\n .ld{width:9px;height:9px;border-radius:2px}\n .summary-grid{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:8px;margin-bottom:1.25rem}\n .metric{background:var(--bg2);border-radius:var(--r);padding:10px 12px}\n .ml{font-size:11px;color:var(--tx2);margin-bottom:3px}\n .mv{font-size:20px;font-weight:500}\n .project-block{margin-bottom:1.1rem;border:0.5px solid var(--bdr);border-radius:var(--rl);overflow:hidden}\n .ph{padding:9px 14px;border-bottom:0.5px solid var(--bdr);display:flex;align-items:center;justify-content:space-between}\n .pn{font-size:13px;font-weight:500}\n .pm{font-size:11px;color:var(--tx2)}\n .th{padding:5px 14px;font-size:11px;font-weight:500;color:var(--tx2);background:var(--bg2);display:flex;align-items:center;gap:6px;border-top:0.5px solid var(--bdr)}\n .tc{background:var(--bg3);color:var(--tx2);padding:1px 6px;border-radius:var(--r);font-size:10px}\n .cols{display:grid;grid-template-columns:80px 1fr 86px 82px 82px 80px 98px;gap:4px;padding:4px 14px;font-size:10px;color:var(--tx3);background:var(--bg2);border-top:0.5px solid var(--bdr)}\n .ir{display:grid;grid-template-columns:80px 1fr 86px 82px 82px 80px 98px;gap:4px;padding:6px 14px;align-items:start;border-top:0.5px solid var(--bdr);font-size:11px}\n .ir.stale{background:rgba(250,238,218,0.3)}\n .ir.highest{background:rgba(252,235,235,0.35)}\n .ir.overdue{background:rgba(252,235,235,0.45)}\n .ir.stale.highest,.ir.stale.overdue{background:rgba(250,220,200,0.45)}\n @media(prefers-color-scheme:dark){\n .ir.stale{background:rgba(99,56,6,0.2)}.ir.highest{background:rgba(121,31,31,0.2)}\n .ir.overdue{background:rgba(121,31,31,0.3)}.ir.stale.highest,.ir.stale.overdue{background:rgba(110,40,6,0.28)}\n }\n .ik{color:var(--info);font-size:10px;font-family:var(--mono);white-space:nowrap;text-decoration:none}\n .ik:hover{text-decoration:underline}\n .is{color:var(--tx);line-height:1.4;overflow:hidden;display:-webkit-box;-webkit-line-clamp:2;-webkit-box-orient:vertical}\n .ia{color:var(--tx2);font-size:10px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}\n .dt{font-size:10px;white-space:nowrap}\n .upd-ok{color:var(--tx2)}.upd-stale{color:#BA7517;font-weight:500}\n .due-ok{color:var(--tx2)}.due-over{color:#A32D2D;font-weight:500}\n .cr{color:var(--tx2)}\n @media(prefers-color-scheme:dark){.upd-stale{color:#FAC775}.due-over{color:#F7C1C1}}\n .dot-h{display:inline-block;width:5px;height:5px;border-radius:50%;background:#E24B4A;margin-right:2px;vertical-align:middle}\n .dot-s{display:inline-block;width:5px;height:5px;border-radius:50%;background:#EF9F27;margin-right:2px;vertical-align:middle}\n .dot-d{display:inline-block;width:5px;height:5px;border-radius:50%;background:#D85A30;margin-right:2px;vertical-align:middle}\n .sb{font-size:10px;padding:2px 6px;border-radius:var(--r);text-align:center;white-space:nowrap}\n .s-ip{background:#FAEEDA;color:#854F0B}.s-td{background:#E1F5EE;color:#0F6E56}\n .s-oi{background:#FCEBEB;color:#A32D2D}.s-xx{background:var(--bg2);color:var(--tx2)}\n @media(prefers-color-scheme:dark){\n .s-ip{background:#633806;color:#FAC775}.s-td{background:#085041;color:#9FE1CB}.s-oi{background:#791F1F;color:#F7C1C1}\n }\n .empty{padding:16px;text-align:center;color:var(--tx3);font-size:12px}\n .footer{font-size:11px;color:var(--tx3);margin-top:24px}\n\n\n\n\nJira Active Issues Report \u2014 DO / IM / S2\n\nGenerated June 26, 2026 at 09:22 AM  \u00b7  Excludes Done, Fixed, Canceled, Deferred  \u00b7  https://karrostech.atlassian.net\n\nLast 24 hrs24\u201348 hrs ago2\u20137 days agoOlder than 7 days\n\n\n Highest priority\n Stale \u22655 business days\n Due date missed\n\n\n\n\n\nDO \u2014 Edulog DevOps\n5\n\nIM \u2014 Incident Management\n1\n\nS2 \u2014 Soc-2 & Security\n9\n \n\n \n\n DO \u2014 Edulog DevOps\n 5 active issues\n \n \n\n KeySummaryAssignee\n CreatedLast updatedDue dateStatus\n \nTask 5\n \n\n DO-2476\n Peoria, AZ - Please Adjust Talend for data areas\n Cory Emlen\n Jun 26, '26\n Jun 26, '26\n \u2014\n Backlog\n \n \n\n DO-2473\n AV2 operator SMS \u2014 SNS IAM (PpSmsSnsDelivery), production access, IaC for AthenaV2SecretGetter\n \u2014\n Jun 25, '26\n Jun 25, '26\n \u2014\n Backlog\n \n \n\n DO-2472\n Alexandria, VA - Student Missing from UI\n \u2014\n Jun 25, '26\n Jun 26, '26\n \u2014\n Backlog\n \n \n\n DO-2471\n Rialto, CA - Please Update ASDI\n Cory Emlen\n Jun 25, '26\n Jun 25, '26\n \u2014\n Backlog\n \n \n\n DO-2461\n Peoria, AZ - Please Set up Planned Rollover\n \u2014\n Jun 25, '26\n Jun 26, '26\n \u2014\n Backlog\n \n \n\n \n\n IM \u2014 Incident Management\n 1 active issue\n \n \n\n KeySummaryAssignee\n CreatedLast updatedDue dateStatus\n \nStory 1\n \n\n IM-7670\n Alberta Classical Opt - network errors when opening Pick A Location\n \u2014\n Jun 26, '26\n Jun 26, '26\n \u2014\n Open Issue\n \n \n\n \n\n S2 \u2014 Soc-2 & Security\n 9 active issues\n \n \n\n KeySummaryAssignee\n CreatedLast updatedDue dateStatus\n \nEpic 1\n \n\n S2-680\n [Q2/26] User Access Review\n Madison Irwin\n Jun 25, '26\n Jun 25, '26\n Jul 15, '26\n To Do\n \nTask 8\n \n\n S2-688\n [Q2/26] 1Password\n Bret Marquardt\n Jun 25, '26\n Jun 25, '26\n Jul 15, '26\n To Do\n \n \n\n S2-687\n [Q2/26] GitHub\n Eric Fischl\n Jun 25, '26\n Jun 25, '26\n Jul 15, '26\n To Do\n \n \n\n S2-686\n [Q2/26] Elasticsearch\n Eric Fischl\n Jun 25, '26\n Jun 25, '26\n Jul 15, '26\n To Do\n \n \n\n S2-685\n [Q2/26] Google Workspace\n Eric Fischl\n Jun 25, '26\n Jun 25, '26\n Jul 15, '26\n To Do\n \n \n\n S2-684\n [Q2/26] AWS\n Eric Fischl\n Jun 25, '26\n Jun 25, '26\n Jul 15, '26\n To Do\n \n \n\n S2-683\n [Q2/26] Parent Portal\n Eric Fischl\n Jun 25, '26\n Jun 25, '26\n Jul 15, '26\n To Do\n \n \n\n S2-682\n [Q2/26] Athena Routing Software\n Eric Fischl\n Jun 25, '26\n Jun 25, '26\n Jul 15, '26\n To Do\n \n \n\n S2-681\n [Q2/26] Microsoft 365\n Bret Marquardt\n Jun 25, '26\n Jun 25, '26\n Jul 15, '26\n To Do\n \n\n\n\nDO \u2014 Edulog DevOps\n1\n\nIM \u2014 Incident Management\n0\n\nS2 \u2014 Soc-2 & Security\n0\n \n\n \n\n DO \u2014 Edulog DevOps\n 1 active issue\n \n \n\n KeySummaryAssignee\n CreatedLast updatedDue dateStatus\n \nTask 1\n \n\n DO-2446\n Kansas City, KS - Athena/Parent Portal Integration\n \u2014\n Jun 24, '26\n Jun 25, '26\n Jul 1, '26\n Backlog\n \n\n\n\nDO \u2014 Edulog DevOps\n1\n\nIM \u2014 Incident Management\n0\n\nS2 \u2014 Soc-2 & Security\n0\n \n\n \n\n DO \u2014 Edulog DevOps\n 1 active issue\n \n \n\n KeySummaryAssignee\n CreatedLast updatedDue dateStatus\n \nTask 1\n \n\n DO-2395\n New Berlin, WI - Please Set Up ASDI\n Cory Emlen\n Jun 19, '26\n Jun 24, '26\n \u2014\n On hold\n \n\n\n\nDO \u2014 Edulog DevOps\n31\n\nIM \u2014 Incident Management\n19\n\nS2 \u2014 Soc-2 & Security\n0\n \n\n \n\n DO \u2014 Edulog DevOps\n 31 active issues\n \n \n\n KeySummaryAssignee\n CreatedLast updatedDue dateStatus\n \nATH New site request 3\n \n\n DO-2229\n Hillsborough, FL - Athena Conversion from Legacy\n JD Holwick\n Jun 9, '26\n Jun 24, '26\n Jun 26, '26\n IN PROGRESS\n \n \n\n DO-2197\n Newport News, VA - Athena Deployment\n JD Holwick\n Jun 4, '26\n Jun 24, '26\n Jun 25, '26\n IN PROGRESS\n \n \n\n DO-1787\n Elyria, OH - Athena Conversion from Legacy\n Cory Emlen\n Mar 17, '26\n Apr 30, '26 (41d)\n Apr 17, '26\n Blocked\n \nBug 4\n \n\n DO-1855\n There is no data available in Route assignment, Live substitution modules of Telematcis for Johnston site\n Mide Dickson\n Mar 26, '26\n Mar 26, '26 (66d)\n \u2014\n To Do\n \n \n\n DO-1854\n There is no data available in multiple pages like Students, Runs, Routes modules of Routing for Johnston site \n Mide Dickson\n Mar 26, '26\n Mar 26, '26 (66d)\n \u2014\n To Do\n \n \n\n DO-1786\n [EastAllen, IN 1.78 Smoke]CA Result CSV \u2013 Export fails for valid dates with 400 Bad Request (invalid page number)\n Dane Elwood\n Mar 17, '26\n Mar 26, '26 (66d)\n \u2014\n Blocked\n \n \n\n DO-1512\n 500 Internal Server Err on Search API [UAT01/1.78]\n Vader\n Feb 27, '26\n May 29, '26 (20d)\n \u2014\n To Do\n \nStory 4\n \n\n DO-2380\n Aldine, TX - Please run Talend script\n Amy Madzelonka\n Jun 18, '26\n Jun 24, '26\n \u2014\n Verification\n \n \n\n DO-2235\n San Bernardino, CA - SY2627 Data Area - delete stops \n Nathan Bible\n Jun 9, '26\n Jun 12, '26 (10d)\n \u2014\n Backlog\n \n \n\n DO-2025\n Birdville, TX - Please deploy Telematics\n Cory Emlen\n Apr 29, '26\n May 7, '26 (36d)\n \u2014\n Verification\n \n \n\n DO-1112\n Lake Superior, MN Clone - Map Work Package\n David Goldberg\n Nov 20, '25\n Mar 9, '26 (79d)\n \u2014\n IN PROGRESS\n \nTask 20\n \n\n DO-2364\n Shared School Services - Set up GTS integration\n Kehinde Metibemu\n Jun 16, '26\n Jun 22, '26\n Jun 18, '26\n Backlog\n \n \n\n DO-2351\n Superior, WI - Please Deploy Web Query\n JD Holwick\n Jun 12, '26\n Jun 15, '26 (9d)\n \u2014\n Backlog\n \n \n\n DO-2262\n Cobb County, GA - Set Up ASDI in fall Sandbox\n Cory Emlen\n Jun 11, '26\n Jun 22, '26\n \u2014\n On hold\n \n \n\n DO-2245\n Newport News, VA - Athena SSO\n Vader\n Jun 10, '26\n Jun 10, '26 (12d)\n \u2014\n IN PROGRESS\n \n \n\n DO-2218\n Johnston, NC - Clone - Stop Checking\n Dan McGuire\n Jun 8, '26\n Jun 10, '26 (12d)\n \u2014\n Backlog\n \n \n\n DO-2165\n Wichita, KS - Update ASDI/Talend to Protect School Code only for 065\n Cory Emlen\n Jun 1, '26\n Jun 22, '26\n \u2014\n Verification\n \n \n\n DO-2101\n Add workforce.edulog.com hosts to Keycloak `driver-portal` client Web Origins + Valid Redirect URIs (3 realms)\n Brandon Donnelson\n May 18, '26\n May 18, '26 (29d)\n \u2014\n IN PROGRESS\n \n \n\n DO-2099\n Add 6 Namecheap CNAMEs for workforce.edulog.com (DP V2 web SPA) + update 3 CloudFront distros with alias + ACM cert\n Brandon Donnelson\n May 18, '26\n May 18, '26 (29d)\n \u2014\n IN PROGRESS\n \n \n\n DO-2055\n Montour-PA - Set up additional ASDI for sandbox 2627sy\n Cory Emlen\n May 7, '26\n Jun 15, '26 (9d)\n \u2014\n Verification\n \n \n\n DO-2006\n Remove non-active Tenants from Grafana Plan Ingestion Global Audit\n JD Hawk\n Aug 25, '25\n Jun 22, '26\n \u2014\n To Do\n \n \n\n DO-1810\n Brevard-FL - Update Tenant Reports \"Bulletin Bus Run\" \n Manuel Esquivel\n Mar 20, '26\n Jun 24, '26\n \u2014\n Backlog\n \n \n\n DO-1748\n San Bernardino, CA - Scan History is showing the wrong time\n Brandon Donnelson\n Mar 11, '26\n Jun 24, '26\n \u2014\n IN PROGRESS\n \n \n\n DO-1425\n Delete AWS Client VPN\n Josiah Brown\n Feb 4, '26\n Feb 18, '26 (92d)\n \u2014\n Backlog\n \n \n\n DO-1158\n Patch CVE-2025-14847 for Mongo Services running 8.0.4\n Vader\n Dec 24, '25\n May 6, '26 (37d)\n \u2014\n On hold\n \n \n\n DO-1125\n Update Crush SG/NACL to not allow internet traffic and restrict to the AWS VPN\n Josiah Brown\n Dec 3, '25\n Feb 18, '26 (92d)\n \u2014\n Backlog\n \n \n\n DO-1077\n Legacy AWS Client Uninstall - Full Cancelation\n Vader\n Nov 13, '25\n Feb 5, '26 (101d)\n \u2014\n On hold\n \n \n\n DO-1049\n Vulnerability - LOW: X-Content-Type-Options Header Missing\n Josiah Brown\n Oct 22, '25\n Mar 3, '26 (83d)\n \u2014\n Backlog\n \n \n\n DO-1048\n Vulnerability - MODERATE: missing anti-clickjacking header\n Josiah Brown\n Oct 22, '25\n Feb 18, '26 (92d)\n \u2014\n Backlog\n \n \n\n DO-1013\n Move all athena-legacy EC2 Instances to have Encrypted EBS Volumes\n Josiah Brown\n Oct 29, '25\n Feb 18, '26 (92d)\n \u2014\n Backlog\n \n \n\n DO-677\n need to implement a lifecycle policy for s3 buckets backups\n \u2014\n May 9, '25\n Feb 18, '26 (92d)\n \u2014\n Backlog\n \n \n\n \n\n IM \u2014 Incident Management\n 19 active issues\n \n \n\n KeySummaryAssignee\n CreatedLast updatedDue dateStatus\n \nStory 19\n \n\n IM-7654\n Telematics is broken for multiple clients\n Mide Dickson\n Jun 12, '26\n Jun 12, '26 (10d)\n \u2014\n WORK IN PROGRESS\n \n \n\n IM-7646\n Summer School Trips not Available\n Brandon Donnelson\n Jun 10, '26\n Jun 24, '26\n \u2014\n Ready for UAT\n \n \n\n IM-7635\n Katy, TX - Bell Time Tasks are taking an hour to save\n Mide Dickson\n Jun 3, '26\n Jun 4, '26 (16d)\n \u2014\n WORK IN PROGRESS\n \n \n\n IM-7634\n East Allen, IN - SY2627 data area has incorrect student information\n Mide Dickson\n Jun 3, '26\n Jun 11, '26 (11d)\n \u2014\n WORK IN PROGRESS\n \n \n\n IM-7623\n PPF - Ride Registration Address Option not working- SM \n Boluwatife Olaifa\n May 28, '26\n Jun 23, '26\n \u2014\n WORK IN PROGRESS\n \n \n\n IM-7569\n Zonar - Delay / Omission of pings to SM, PP\n Nick Sundberg\n May 5, '26\n May 8, '26 (35d)\n \u2014\n Open Issue\n \n \n\n IM-7550\n Cleveland, OH - Not able to track buses - GPS tracking down\n Kehinde Metibemu\n Apr 30, '26\n Apr 30, '26 (41d)\n \u2014\n Open Issue\n \n \n\n IM-7548\n Cobb County, GA - Severely Degraded Athena Performance\n Brandon Donnelson\n Apr 29, '26\n Jun 5, '26 (15d)\n \u2014\n Open Issue\n \n \n\n IM-7547\n Rochambeau, MD - Busses 203/204 have not had movement in Parent Porta Lite since 7:30 PM on 4/27\n Vader\n Apr 29, '26\n Jun 23, '26\n \u2014\n Open Issue\n \n \n\n IM-7545\n Framingham, MA and Tony's Team MB - No GPS activity this morning\n \u2014\n Apr 28, '26\n Apr 28, '26 (43d)\n \u2014\n Open Issue\n \n \n\n IM-7544\n Cobb, Ga - bulk set all employee passwords to 9999\n Vader\n Apr 28, '26\n Jun 23, '26\n \u2014\n Open Issue\n \n \n\n IM-7543\n East Allen, IN - Student Documents just shows loading gears \n Vader\n Apr 28, '26\n Apr 28, '26 (43d)\n \u2014\n WORK IN PROGRESS\n \n \n\n IM-7542\n Edmonds, WA - Parent Portal not showing Transportation Info\n \u2014\n Apr 27, '26\n Apr 27, '26 (44d)\n \u2014\n Open Issue\n \n \n\n IM-7529\n Aldine, TX - student import did not run last night\n Eric Fischl\n Apr 23, '26\n Apr 24, '26 (45d)\n \u2014\n WORK IN PROGRESS\n \n \n\n IM-7522\n PPF - Bus Visibility Error - Los Alamitos\n Brandon Donnelson\n Apr 20, '26\n Apr 29, '26 (42d)\n \u2014\n Open Issue\n \n \n\n IM-7514\n San Bernardino, CA - Telematics > On time performance reports show no data \n Vader\n Apr 10, '26\n Jun 23, '26\n \u2014\n Open Issue\n \n \n\n IM-7488\n Chicago, IL - Log in error - Cookie not found\n Amy Madzelonka\n Apr 7, '26\n Apr 12, '26 (55d)\n \u2014\n Open Issue\n \n \n\n IM-7449\n Pitt, NC missing valid parsing files in the deployment/import for the site.\n \u2014\n Mar 19, '26\n Mar 19, '26 (71d)\n \u2014\n Open Issue\n \n \n\n IM-7445\n Cleveland, OH - All Stop Durations were Changed, Please Investigate and Restore a Backup\n \u2014\n Mar 17, '26\n Mar 19, '26 (71d)\n \u2014\n Open Issue\n \n\nData sourced live from Jira on June 26, 2026 at 09:22 AM.\n\nfunction showTab(key,el){\n document.querySelectorAll('.tab').forEach(t=>t.classList.remove('active'));\n el.classList.add('active');\n document.querySelectorAll('.pane').forEach(p=>p.style.display='none');\n document.getElementById('pane-'+key).style.display='block';\n}\n\n\n", "creation_timestamp": "2026-06-26T15:23:37.685874Z"}