Release by US-CERT. Another protocol downgrade attack. Similar to the OpenSSH downgrade attack from years ago. Of course, OpenSSL is the culprit again, as was with Heartbleed. What's the point of providing broken security for "legacy" reasons? It's broken.

Link with details of the issue: https://www.us-cert.gov/ncas/alerts/TA14-290A