...
For Admin Interface clients / proxies that are exposed to the internet it is crucial that the highest/securest version of Tomcat is used. The highest version most commonly contains security fixes of common vulnerabilities and exposures (CVEs). Any version of our Admin Interface / HttpProxy / ArchiveServer can (in general) always be made to work as long as the correct Java version is used, matching the indicated JRE version for the Delft-FEWS release version.
See http://tomcat.apache.org/security-9.html
...