[jetty-user] "CVE-2009-3555 Prevent SSL renegotiate for SSL vulnerability" not fixed?

We are using Jetty 6.1.22, which supposedly contains a fix for
CVE-2009-3555.  However, one of our customer's security scanners is flagging
our server has having this vulnerability.

After doing some research, I found this site regarding how to verify that
SSL Renegotiation is disabled.

http://blog.ivanristic.com/2009/12/testing-for-ssl-renegotiation.html

Basically, you use openssl to connect, send a 'HEAD' request, initiate
renegotiation, and you *should* receive an error, as show below:

$ openssl s_client -connect server:443

[snip... a lot of openssl output]

---

HEAD / HTTP/1.0<press enter>
R<press enter>
RENEGOTIATING
<press enter>
28874:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake
failure:s3_pkt.c:530:

However, Jetty does NOT generate a renegotiation failure.  In fact it
continues with renegotiation and returns the content of the head request.

Jetty 6.1.22's SslSelectChannelConnector is supposed to default to no
renegotiation (allowRenegotiate=false), but even when I set it explicitly in
the .xml configuration to false, it still seems to honor the renegotiation.

Can anyone shed light on this, this is a serious problem if CVE-2009-3555 is
not really fixed.

-Brett