OpenSSL Security Advisory
CVE-2014-0224 looks the worst of this bunch.<p>It seems openssl will accept ChangeCipherSpec messages much too early.  CCS in TLS means "we've finished handshake/renegotiation and will now start using the new keys".<p>It looks likely that a MITM can send CCS to both ends during handshake, and have them agree on the empty master secret (and therefore trivial application data encryption keys).  This is pretty bad as far as TLS bugs go (as bad as "goto fail", but not as bad as "heartbleed").<p>Given that accepting TLS messages only within the right constraints is fundamental to correctness of TLS and openssl seemingly can't get this right (this, and heartbeat messages before/during handshake), it seems likely this isn't the last problem of this kind.