[jetty-dev] CVE-2009-3555 SSL vulnerability fix

[Greg Wilkins <gregw@xxxxxxxxxxx>]

All,

I've committed a work around to the CVE-2009-3555 SSL vulnerability
to jetty-6, plus a test harness that demonstrates that renegotiation
has been disabled by the workaround. (both SslSocketConnector and SslSelectChannelConnector)

This approach appears to be favoured by all those trying to work around
this issue while waiting for Sun to fix the JVMs.

I will commit a similar patch to jetty-7 over the weekend.

I would be very interested to hear any feedback from SSL users that
this has not broken their usage.

We will have releases with this patch available early in the week.

Older releases might be able to be patched by substitution of the
SSL classes.

regards