Your friendly security team received the following report via vendor-sec.
Please respond ASAP.
This issue is not public yet, please keep any information about it inside SUSE.
Note that build.opensuse.org *cannot* be used to prepare embargoed updates.

CRD 27.05.

------------------------------------------------------------------------------
Date: Wed, 28 Apr 2010 17:09:33 -0700
From: Geoff Keating <geoffk@apple.com>
Subject: [vendor-sec] Character set issue in Ruby WEBrick

We've found an issue in WEBrick.  Our draft description is as follows:

----------------------
Ruby

CVE-ID:  CVE-2010-0541

Impact:  A remote attacker may gain access to accounts served by Ruby
WEBrick

Description:  A cross-site scripting issue exists in the Ruby WEBrick
HTTP server's handling of error pages. Accessing a maliciously
crafted URL in certain web browsers may cause the error page to be
treated as UTF-7, allowing JavaScript injection. This update
addresses the issue by setting UTF-8 as the default character set in
HTTP error responses. Credit: Apple.
----------------------

"Certain web browsers" means IE6 or anything else that guesses UTF-7 as a character set if none is specified.  The issue can be detected by accessing a web page that does not exist, and noting

Content-Type: text/html

instead of the correct

Content-Type: text/html; charset=utf-8


The WEBrick website appears to be down, does anyone have a contact for the authors?

The patch we applied to address this issue was:

--- lib/webrick/httpresponse.rb.old	2010-03-31 18:47:40.000000000 -0700
+++ lib/webrick/httpresponse.rb	2010-03-31 18:48:21.000000000 -0700
@@ -209,7 +209,7 @@
        @keep_alive = false
        self.status = HTTPStatus::RC_INTERNAL_SERVER_ERROR
      end
-      @header['content-type'] = "text/html"
+      @header['content-type'] = "text/html; charset=utf-8"

      if respond_to?(:create_error_page)
        create_error_page()

Proposed embargo date:

This issue should remain embargoed until 27 May 2010.  If there are any problems with this date, please let us know.