Recently the CCS Injection was discovered in OpenSSL (CVE-2014-0224) http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0224. It allows man-in-the-middle attackers to consequently hijack sessions or obtain sensitive information.
Is it critical?
Is it required to immediate upgrade OpenSSL?
How it is risky related to OpenSSL Heartbleed (CVE-2014-0160)?
CCS Injection requires an active attacker, but does allow an active attacker to downgrade the connection to a predictable key, so the attacker can then read all traffic being passed. It requires both endpoints be vulnerable, so not nearly as many users should be affected as were for heartbleed. That being said, an active attacker can recover 100% of the traffic from sessions that they are able to MITM.
So fewer users at risk, harder to execute the attack, but when executed, arguably much worse (100% session recovery). I would upgrade immediately.
@david is correct that an attacker must be privileged: this is a MITM attack. There's another important detail: both users (server and client) must be using a vulnerable version of OpenSSL. For the web, while many servers use OpenSSL, none of the most popular clients do. None of Chrome, IE, Safari, Firefox, or Opera on the desktop use OpenSSL. See Which browsers are using openssl
