[POLICY] tomcat security upgrade legacy components