OpenBSD 5.4 errata 8, Apr 12, 2014:  A use-after-free race condition
in OpenSSL's read buffer may permit an attacker to inject data from
one connection into another.

The advice in the previous OpenSSL errata also applies.

Apply patch using:

    cat 008_openssl.patch | (cd /usr/src && patch -p0)

Then build and install libssl

    cd /usr/src/lib/libssl/ssl
    make obj
    make
    make install

Also recompile any statically-linked binaries depending on it - in
the base OS, this is just ftp(1):

    cd /usr/src/usr.bin/ftp
    make obj
    make clean
    make
    make install

Then restart services which depend on SSL.

Index: lib/libssl/src/ssl/s3_pkt.c
===================================================================
RCS file: /cvs/src/lib/libssl/src/ssl/s3_pkt.c,v
retrieving revision 1.19
retrieving revision 1.19.4.1
diff -u -p -u -r1.19 -r1.19.4.1
--- lib/libssl/src/ssl/s3_pkt.c	14 Feb 2013 15:11:43 -0000	1.19
+++ lib/libssl/src/ssl/s3_pkt.c	12 Apr 2014 17:00:53 -0000	1.19.4.1
@@ -1054,7 +1054,7 @@ start:
 				{
 				s->rstate=SSL_ST_READ_HEADER;
 				rr->off=0;
-				if (s->mode & SSL_MODE_RELEASE_BUFFERS)
+				if (s->mode & SSL_MODE_RELEASE_BUFFERS && s->s3->rbuf.left == 0)
 					ssl3_release_read_buffer(s);
 				}
 			}