A tomcat bugfix update has been released for CentOS 7.

CentOS-announce: CESA-2020:5020 Low CentOS 7 tomcat Security Update

CentOS Errata and Security Advisory 2020:5020 Low

Upstream details at :   https://access.redhat.com/errata/RHSA-2020:5020

The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )

x86_64:
3d1a72d4d1f896acb82915d2121ccc8032a2e15e43ba9390abbf0c6e1ddfdb81 tomcat-7.0.76-16.el7_9.noarch.rpm
a1a79207d7fe88ceb95e5e7c1c63bd1c59cb5a98169680429a87fdd1ee285aba tomcat-admin-webapps-7.0.76-16.el7_9.noarch.rpm
94003135dce2fc46854f2202251cb46b096bbabd25f6b98e55704280bf4d77d8 tomcat-docs-webapp-7.0.76-16.el7_9.noarch.rpm
93d3b99f0fd9bf0940325c81b2d8cadba8f402c03b3b36117a666eb53a39d4ae tomcat-el-2.2-api-7.0.76-16.el7_9.noarch.rpm
199014d97d9be442d1dce91e30112d132e8c5ac82003d8631976c1607ad2e159 tomcat-javadoc-7.0.76-16.el7_9.noarch.rpm
821d095b31cdbab402488cd14bacefa75cb451e7fbd956f61a6bc92a68d59f68 tomcat-jsp-2.2-api-7.0.76-16.el7_9.noarch.rpm
7013395de5d70b992ff1cb20c5fcc916c7f545ed46a9021f6f2105e575039bfc tomcat-jsvc-7.0.76-16.el7_9.noarch.rpm
4f2b6dd685c3fa625585b5fe41f9b3277cb8925b675a3b8add0c89efb81b9de9 tomcat-lib-7.0.76-16.el7_9.noarch.rpm
b7b726f83f6133f92e0037c54e043aa50a4cdcd0b17600cdcd827769833b0ae2 tomcat-servlet-3.0-api-7.0.76-16.el7_9.noarch.rpm
7c0a15ef78a1950328029433601564ae9606ccc8e17e7470a5e84088ce0cd908 tomcat-webapps-7.0.76-16.el7_9.noarch.rpm

Source:
baa57046d17dbcb0a1451e93c1fefbff1dc8494b3c5061a545f0257b6e571413 tomcat-7.0.76-16.el7_9.src.rpm