Hi All, On one of our firewalls we hosting a application/service which impacts clients and we recently conducted a Pen test, the external company doing the Pen test have advised us that there is a vulnerability relating to OpenSSL. We have checked the server and there is no OpenSSL installed so the only place where it could be picking this up is on the ASA, is this correct? Here is the report from the company that conducted the test: 4.3 Network Security An outdated OpenSSL package was identified that was vulnerable to a heap corruption bug that may be exploited by an attacker to acquire command execution on the host, or to create denial of service conditions. Table 7   provides an overview of the risk identified per network assessment category,   along with recommendations for resolving the issues identified. Category Risk Summary Recommendations Patch Management High The OpenSSL package installed   on one host was identified as being outdated and subject to a heap corruption   bug. Update the outdated /   vulnerable OpenSSL package to the latest stable version. We have an ASA5520 and running the following version: Cisco Adaptive Security Appliance Software Version 8.2(5)2 How do we check the OpenSSL on the ASA and secondly do we need to update the ASA software version ??? Thanks Zubair ... View more