In which version of foreman will tomcat be updated as well?

Development
,
1

It seems like apache tomcat version is 9.30.0, which presents a security vulnerability. When will tomcat be updated to the latest version?

2

AFAIK we don’t package tomcat ourselves but use it from the base OS. Can you share a bit more about your concerns? And perhaps also which OS + version you’re using?

3

We are running Red Hat 7, there is a significant Apache Tomcat vulnerability that needs to be mitigated.

4

As already mentioned, Tomcat is installed from the OS repos (in your case from RHEL7). RedHat typically does not update the software shipped to new versions (that’s what SCL and now module-streams are for), but instead backports fixes for important bugs and security issues to the old versions.
I don’t know what security issue you are talking about, but you can check with RedHat if that has been fixed in any version of Tomcat for RHEL7. If so, it will still be tomcat 9.30.0, but in a newer RedHat build (usually indicated as 9.30.0-XY).