Description
When a server does not support secure renegotiation in SSL/TLS connections, it becomes vulnerable to content injection at the start of sessions. This vulnerability requires the server to also support client-initiated renegotiations.
Recommendation
To address this vulnerability, update the web server application and configure it according to the vendor’s recommendations for production environments. Below is the configuration for Apache HTTP Server.
Set below directive in Apache configuration:
SSLOptions +StdEnvVars
And add below variable to your environment variables:
SSL_SECURE_RENEG=true