Security Update for Apache Tomcat of B1if (SAP Business One)

[Michael_L179]

Hello,

We have installed SAP Business One for Hana FP2405 with B1if but our security team have detected security issues with the version of Apache Tomcat used by B1if in that version. The problem is that even your last version  (at the time I'm writing this question) of SAP Business One for Hana (PL 2511) is shipped with Apache Tomcat 10.1.44 which already have security issues (https://www.cvedetails.com/version/1991106/Apache-Tomcat-10.1.44.html) .
So we want to know if it's possible to apply only security update to Apache Tomcat and also if you have a procedure for that because as it's going there alwayse be a gap between the time a new Apache Tomcat security update is released and the time you release a security patch so every systems are vulnerable in this period. 
If it's not possible what solution do you recommend?

Thank you
Michael