The vulnerability is with Perl version used.

Currently supported ST versions 5.2.x do no use Perl (apart during install phase on RHEL with embedded MySQL database) thus not affected

Pre-5.3.1 versions are using older non vulnerable mysql versions.

For the affected 5.3.1 and 5.3.3 ST versions - fixed via MySQL upgrade to a non-vulnerable version

Specific to the Tomcat version used in ST 5.0

5.2.1 SP2 to 5.2.1 SP6 are using OpenSSL, but not for networking.

5.2.1 SP7 is not using OpenSSL.

5.3.0 is using OpenSSL, but not for networking.

5.3.1 is using OpenSSL, but not for networking.

5.3.3 and above are not using OpenSSL

The JmxRemoteLifecycleListener was not updated to take account of Oracle's fix for CVE-2016-3427. Therefore, Tomcat installations using this listener remained vulnerable to a similar remote code execution vulnerability. This issue has been rated as important rather than critical due to the small number of installations using this listener and that it would be highly unusual for the JMX ports to be accessible to an attacker even when the listener is used.

This was fixed in revision 1767676.

This issue was reported to the Apache Tomcat Security Team on 19 October 2016 and made public on 22 November 2016.

Affects: 7.0.0 to 7.0.72

See:
Apache Tomcat page
Mitre status is still RESERVED

Fixed in ST 5.3.1 Patch 14 with update to tomcat 7.0.75

The code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response, the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other than their own.

This was fixed in revision 1767675.

This issue was reported to the Apache Tomcat Security Team on 11 October 2016 and made public on 22 November 2016.

Affects: 7.0.0 to 7.0.72

See :
Apache Tomcat page
Mitre status is still RESERVED.

Fixed in 5.3.1 patch 14 with update to tomcat 7.0.75

Fixed in 5.3.1 Patch 12 with update to Tomcat 7.0.72

Timing Attack

The Realm implementations did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder.

This was fixed in revision 1758502.

This issue was identified by the Apache Tomcat Security Team on 1 January 2016 and made public on 27 October 2016.

Affects: 7.0.0 to 7.0.70

See: https://tomcat.apache.org/security-7.html

Fixed in 5.3.1 patch 12 with update to tomcat 7.0.72

Generic item describing use of a Broken or Risky Cryptographic Algorithm

Each case to be treated separately based on use case reported specifics.

The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.

OpenVPN, when using a 64-bit block cipher, makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTP-over-OpenVPN session using Blowfish in CBC mode, aka a "Sweet32" attack.

Removing 3DES and DES ciphers from respective daemons ciphers suites eliminates the issue, however in case for AS2 3DES is a must when used with FIPS 140-2.

Recommended approach is upgrade to ST 5.3.3

ST is not vulnerable.