SSL/TLS: Renegotiation Vulnerability

[pgnair]

Hi,

I guess you've been using Indy server here is that correct?

From the issue:

> The referenced CVEs are affecting OpenSSL and Mozilla Network Security Services (NSS) but both are in a DISPUTED state

If you are using Indy (which uses OpenSSL) this will certainly affect your application. I think, once it is in disputed state, I believe you should just inform that you are using OpenSSL to provide SSL services.

>I guess you've been using Indy server here is that correct?
Yes am using Indy Server.

>If you are using Indy (which uses OpenSSL)
OpenSSL dlls are using

>I believe you should just inform that you are using OpenSSL
They might not accept such a comment. Is there any solution for this?