a2a-java vulnerabilities

A security vulnerability has been detected in a2aproject a2a-java up to 1.2.0.Final. This impacts the function TaskManager.saveTaskEvent. The manipulation leads to a race condition. The attack may be initiated remotely. Upgrading to version 1.3.0.Final fixes this issue (patch identifier: 6b8e1e085c35e970ef0048901cd25850e4791ec2).

A weakness has been identified in a2aproject a2a-java up to 1.2.0.Final. This affects the function InMemoryPushNotificationConfigStore.setInfo of the file extras/push-notification-config-store-database-jpa/src/main/java/org/a2aproject/sdk/extras/pushnotificationconfigstore/database/jpa/JpaDatabasePushNotificationConfigStore.java of the component Push Notification Config Store. Manipulation can lead to resource consumption. The attack can be launched remotely. Upgrading to version 1.3.0.Final mitigates this issue (patch: b478810a03b4a16841d36aca5c6e87d8f48fce67).

A security flaw has been discovered in a2aproject a2a-java up to 1.2.0.Final. The impacted element is the function queue.offer of the component ChildQueue. Manipulation results in resource consumption. The attack can be initiated remotely. Upgrading to version 1.3.0.Final is sufficient to resolve this issue (patch: be663f806efcfdddd2805d214fae4998379ac5f2).

A flaw was found in a2a-java up to 1.2.0.Final affecting the getMessage function of the JSON-RPC Error Handler component. The manipulation causes information exposure through error messages. The attack can be launched remotely, and upgrading to version 1.3.0.Final fixes the issue.

A vulnerability has been detected in a2aproject a2a-java 1.2.0, in the function AuthorizationRequestHandlerDecorator.onListTasks, leading to missing authorization. The attack can be launched remotely. Upgrading to version 1.3.0 resolves the issue.

A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSender.dispatchNotification of the file server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java of the component Authorization Header Construction. This manipulation causes http response splitting. The attack can be initiated remotely. Upgrading to version 1.3.0 is sufficient to fix this issue. Patch name: 247a655043f145f6f8e3853724b6a543eaa02001. You should upgrade the affected component.