In September, 2016, a security vulnerability was reported in OpenSSL, which affects the version of Python bundled with ArcGIS Pro.
Python fixed the problem on November 1, 2016. It has been 3 months since November 1, 2016.
When will ArcGIS Pro be patched?
python is not updated by esri that quickly. if you think there is an issue, you should be able to fix/update it yourself since PRO uses a conda distribution... albeit with python 3.4... you can get the distribution directly from continuum, or if you are using ArcGIS Pro 1.4, use the esri distributed conda manager... the continuum link is https://anaconda.org/anaconda/openssl
The package manager can be found in this link