Please follow https://www.us-cert.gov/ncas/current-activity/2018/10/31/Apache-Releases-Security-Update-Apache-Tomcat-JK-Connectors.