A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery

影響: maven:org.a2aproject.sdk:a2a-java-sdk-server-common < 1.3.0.Final → 1.3.0.Final --- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common (push-notification delivery) - Affected versions: /latest/meta-data/iam/security-credentials/. Use returnImmediately: true, header A2A-Version: 1.0, and role ROLE_USER. The URL is stored verbatim. (Equivalent via CreateTaskPushNotificationConfig on an existing task.) 3. As the task emits state/artifact updates, the sender POSTs each one to the stored URL, from the server's own network position: POST /latest…

GitHub Advisory Databaseで読む