OpenBSD 5.4 errata 8, Apr 12, 2014:  A use-after-free race condition
in OpenSSL's read buffer may permit an attacker to inject data from
one connection into another.

The advice in the previous OpenSSL errata also applies.

Apply patch using:

   cat 008_openssl.patch | (cd /usr/src && patch -p0)

Then build and install libssl

   cd /usr/src/lib/libssl/ssl
   make obj
   make
   make install

Also recompile any statically-linked binaries depending on it - in
the base OS, this is just ftp(1):

   cd /usr/src/usr.bin/ftp
   make obj
   make clean
   make
   make install

Then restart services which depend on SSL.

Index: lib/libssl/src/ssl/s3_pkt.c
===================================================================
RCS file: /cvs/src/lib/libssl/src/ssl/s3_pkt.c,v
retrieving revision 1.19
retrieving revision 1.19.4.1
diff -u -p -u -r1.19 -r1.19.4.1
--- lib/libssl/src/ssl/s3_pkt.c 14 Feb 2013 15:11:43 -0000      1.19
+++ lib/libssl/src/ssl/s3_pkt.c 12 Apr 2014 17:00:53 -0000      1.19.4.1
@@ -1054,7 +1054,7 @@ start:
                               {
                               s->rstate=SSL_ST_READ_HEADER;
                               rr->off=0;
-                               if (s->mode & SSL_MODE_RELEASE_BUFFERS)
+                               if (s->mode & SSL_MODE_RELEASE_BUFFERS && s->s3->rbuf.left == 0)
                                       ssl3_release_read_buffer(s);
                               }
                       }