tomcat / apache PCI Audit

Red Hat says it will not update apache:
RHEL 7: RPM Package name is tomcat. Based on upstream Tomcat 7 and the latest package is based on 7.0.76
(we also provided some rpm packages based on 7.0.42, 7.0.54 and 7.0.69 in the previous releases.)

We are currently on 7.0.76 but failing PCI audit which says to update apache, Anyone else have this issue? What do you do? Do we have to upgrade to RHEL 8 and JBOSS?