Tomcat major versions are not a single character

[pombredanne]

In https://github.com/nexB/vulnerablecode/blob/24e33966bae6124e381556e520e18f1129c352fc/vulnerabilities/importers/apache_tomcat.py#L65

i[0] is problematic as it is just grabbing one character from a version which could be None... I reckon this is to fetch the major version of tomcat, but then version 10 is out and is taking two characters making this code moot.

This should be updated to handle versions correctly without using a magic [0] instead, but proper version parsing with univers

[sbs2001]

Fixed via ca2293a#diff-981a5adf1835110a3a92846b27455500338f2f724e32ae5cd8b876e30104b571