From fbfeb695d610c02a36f207396e2d5cd0f07ec477 Mon Sep 17 00:00:00 2001
From: thenatog <thenatog@gmail.com>
Date: Mon, 8 Oct 2018 12:58:20 -0400
Subject: [PATCH 1/4] NIFI-5665 - Setting zookeeper's io.netty:netty transitive
 dependency version to 3.10.6.Final.

NIFI-5665 - Setting all transitive io.netty dependencies to 3.10.6.Final.

NIFI-5665 - Added comments.

NIFI-5665 - Missed zookeeper in some spots.

NIFI-5665 - Reverted Flume version. The netty version contained was not listed explicitly as vulnerable.
---
 nifi-nar-bundles/nifi-atlas-bundle/pom.xml       |  6 ++++++
 .../nifi-record-utils/pom.xml                    | 11 +++++++++++
 nifi-nar-bundles/nifi-framework-bundle/pom.xml   |  6 ++++++
 .../nifi-hadoop-libraries-bundle/pom.xml         | 10 ++++++++++
 nifi-nar-bundles/nifi-hive-bundle/pom.xml        | 11 +++++++++++
 nifi-nar-bundles/nifi-kafka-bundle/pom.xml       |  6 ++++++
 .../nifi-kite-processors/pom.xml                 | 16 ++++++++++++++++
 .../nifi-parquet-processors/pom.xml              | 10 ++++++++++
 nifi-nar-bundles/nifi-riemann-bundle/pom.xml     |  6 ++++++
 nifi-nar-bundles/nifi-spark-bundle/pom.xml       |  7 ++++++-
 .../pom.xml                                      |  6 ++++++
 nifi-toolkit/pom.xml                             |  7 +++++++
 12 files changed, 101 insertions(+), 1 deletion(-)

diff --git a/nifi-nar-bundles/nifi-atlas-bundle/pom.xml b/nifi-nar-bundles/nifi-atlas-bundle/pom.xml
index e4db5a651fe1..5a9038dd4e53 100644
--- a/nifi-nar-bundles/nifi-atlas-bundle/pom.xml
+++ b/nifi-nar-bundles/nifi-atlas-bundle/pom.xml
@@ -36,6 +36,12 @@
 
     <dependencyManagement>
         <dependencies>
+            <dependency>
+                <!-- Explicitly force Netty to 3.10.6 because versions prior to 3.9.0 had a CVE -->
+                <groupId>io.netty</groupId>
+                <artifactId>netty</artifactId>
+                <version>3.10.6.Final</version>
+            </dependency>
             <dependency>
                 <groupId>org.apache.nifi</groupId>
                 <artifactId>nifi-atlas-reporting-task</artifactId>
diff --git a/nifi-nar-bundles/nifi-extension-utils/nifi-record-utils/pom.xml b/nifi-nar-bundles/nifi-extension-utils/nifi-record-utils/pom.xml
index d516ba4e8810..035f2ddd1b00 100644
--- a/nifi-nar-bundles/nifi-extension-utils/nifi-record-utils/pom.xml
+++ b/nifi-nar-bundles/nifi-extension-utils/nifi-record-utils/pom.xml
@@ -30,4 +30,15 @@
 	<module>nifi-mock-record-utils</module>
     </modules>
 
+    <dependencyManagement>
+        <dependencies>
+            <dependency>
+                <!-- Explicitly force Netty to 3.10.6 because versions prior to 3.9.0 had a CVE -->
+                <groupId>io.netty</groupId>
+                <artifactId>netty</artifactId>
+                <version>3.10.6.Final</version>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
+
 </project>
diff --git a/nifi-nar-bundles/nifi-framework-bundle/pom.xml b/nifi-nar-bundles/nifi-framework-bundle/pom.xml
index 77de2db037c8..06f4be074e9e 100644
--- a/nifi-nar-bundles/nifi-framework-bundle/pom.xml
+++ b/nifi-nar-bundles/nifi-framework-bundle/pom.xml
@@ -601,6 +601,12 @@
                 <artifactId>commons-net</artifactId>
                 <version>3.6</version>
             </dependency>
+            <dependency>
+                <!-- Explicitly force Netty to 3.10.6 because versions prior to 3.9.0 had a CVE -->
+                <groupId>io.netty</groupId>
+                <artifactId>netty</artifactId>
+                <version>3.10.6.Final</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>
 </project>
diff --git a/nifi-nar-bundles/nifi-hadoop-libraries-bundle/pom.xml b/nifi-nar-bundles/nifi-hadoop-libraries-bundle/pom.xml
index 77716eedee4b..c4f72c3bb984 100644
--- a/nifi-nar-bundles/nifi-hadoop-libraries-bundle/pom.xml
+++ b/nifi-nar-bundles/nifi-hadoop-libraries-bundle/pom.xml
@@ -26,4 +26,14 @@
     <modules>
         <module>nifi-hadoop-libraries-nar</module>
     </modules>
+    <dependencyManagement>
+        <dependencies>
+            <dependency>
+                <!-- Explicitly force Netty to 3.10.6 because versions prior to 3.9.0 had a CVE -->
+                <groupId>io.netty</groupId>
+                <artifactId>netty</artifactId>
+                <version>3.10.6.Final</version>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
 </project>
diff --git a/nifi-nar-bundles/nifi-hive-bundle/pom.xml b/nifi-nar-bundles/nifi-hive-bundle/pom.xml
index c67a26775541..8bc55a7fbd94 100644
--- a/nifi-nar-bundles/nifi-hive-bundle/pom.xml
+++ b/nifi-nar-bundles/nifi-hive-bundle/pom.xml
@@ -35,6 +35,17 @@
         <module>nifi-hive3-nar</module>
     </modules>
 
+    <dependencyManagement>
+        <dependencies>
+            <dependency>
+                <!-- Explicitly force Netty to 3.10.6 because versions prior to 3.9.0 had a CVE -->
+                <groupId>io.netty</groupId>
+                <artifactId>netty</artifactId>
+                <version>3.10.6.Final</version>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
+
     <properties>
         <hive.version>1.2.1</hive.version>
         <hive.hadoop.version>2.6.2</hive.hadoop.version>
diff --git a/nifi-nar-bundles/nifi-kafka-bundle/pom.xml b/nifi-nar-bundles/nifi-kafka-bundle/pom.xml
index 04790c899501..f44e1e1d5666 100644
--- a/nifi-nar-bundles/nifi-kafka-bundle/pom.xml
+++ b/nifi-nar-bundles/nifi-kafka-bundle/pom.xml
@@ -77,6 +77,12 @@
                 <artifactId>nifi-kafka-2-0-processors</artifactId>
                 <version>1.8.0-SNAPSHOT</version>
             </dependency>
+            <dependency>
+                <!-- Explicitly force Netty to 3.10.6 because versions prior to 3.9.0 had a CVE -->
+                <groupId>io.netty</groupId>
+                <artifactId>netty</artifactId>
+                <version>3.10.6.Final</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>
 </project>
diff --git a/nifi-nar-bundles/nifi-kite-bundle/nifi-kite-processors/pom.xml b/nifi-nar-bundles/nifi-kite-bundle/nifi-kite-processors/pom.xml
index 0ff664a953c3..22a2912eb925 100644
--- a/nifi-nar-bundles/nifi-kite-bundle/nifi-kite-processors/pom.xml
+++ b/nifi-nar-bundles/nifi-kite-bundle/nifi-kite-processors/pom.xml
@@ -288,6 +288,22 @@
 
     </dependencies>
 
+    <dependencyManagement>
+        <dependencies>
+            <dependency>
+                <groupId>org.apache.nifi</groupId>
+                <artifactId>nifi-kite-processors</artifactId>
+                <version>1.8.0-SNAPSHOT</version>
+            </dependency>
+            <dependency>
+                <!-- Explicitly force Netty to 3.10.6 because versions prior to 3.9.0 had a CVE -->
+                <groupId>io.netty</groupId>
+                <artifactId>netty</artifactId>
+                <version>3.10.6.Final</version>
+            </dependency>
+    </dependencies>
+    </dependencyManagement>
+
     <build>
         <plugins>
             <plugin>
diff --git a/nifi-nar-bundles/nifi-parquet-bundle/nifi-parquet-processors/pom.xml b/nifi-nar-bundles/nifi-parquet-bundle/nifi-parquet-processors/pom.xml
index 57eed83f90ac..d5a7913286e0 100644
--- a/nifi-nar-bundles/nifi-parquet-bundle/nifi-parquet-processors/pom.xml
+++ b/nifi-nar-bundles/nifi-parquet-bundle/nifi-parquet-processors/pom.xml
@@ -82,6 +82,16 @@
             <scope>test</scope>
         </dependency>
     </dependencies>
+    <dependencyManagement>
+        <!-- Explicitly force Netty to 3.10.6 because versions prior to 3.9.0 had a CVE -->
+        <dependencies>
+            <dependency>
+                <groupId>io.netty</groupId>
+                <artifactId>netty</artifactId>
+                <version>3.10.6.Final</version>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
 
     <build>
         <plugins>
diff --git a/nifi-nar-bundles/nifi-riemann-bundle/pom.xml b/nifi-nar-bundles/nifi-riemann-bundle/pom.xml
index 8f0f8b22a137..c652aaf72326 100644
--- a/nifi-nar-bundles/nifi-riemann-bundle/pom.xml
+++ b/nifi-nar-bundles/nifi-riemann-bundle/pom.xml
@@ -44,6 +44,12 @@
                 <artifactId>nifi-riemann-processors</artifactId>
                 <version>1.8.0-SNAPSHOT</version>
             </dependency>
+            <dependency>
+                <!-- Explicitly force Netty to 3.10.6 because versions prior to 3.9.0 had a CVE -->
+                <groupId>io.netty</groupId>
+                <artifactId>netty</artifactId>
+                <version>3.10.6.Final</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>
 </project>
\ No newline at end of file
diff --git a/nifi-nar-bundles/nifi-spark-bundle/pom.xml b/nifi-nar-bundles/nifi-spark-bundle/pom.xml
index 322b11238aa4..57e290368a17 100644
--- a/nifi-nar-bundles/nifi-spark-bundle/pom.xml
+++ b/nifi-nar-bundles/nifi-spark-bundle/pom.xml
@@ -63,6 +63,12 @@
                 <artifactId>jersey-client</artifactId>
                 <version>1.19.1</version>
             </dependency>
+            <dependency>
+                <!-- Explicitly force Netty to 3.10.6 because versions prior to 3.9.0 had a CVE -->
+                <groupId>io.netty</groupId>
+                <artifactId>netty</artifactId>
+                <version>3.10.6.Final</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>
 
@@ -81,6 +87,5 @@
             <artifactId>nifi-processor-utils</artifactId>
             <version>1.8.0-SNAPSHOT</version>
         </dependency>
-
     </dependencies>
 </project>
\ No newline at end of file
diff --git a/nifi-nar-bundles/nifi-standard-services/nifi-hbase_1_1_2-client-service-bundle/pom.xml b/nifi-nar-bundles/nifi-standard-services/nifi-hbase_1_1_2-client-service-bundle/pom.xml
index 0b16b4742a0c..abb3075554cd 100644
--- a/nifi-nar-bundles/nifi-standard-services/nifi-hbase_1_1_2-client-service-bundle/pom.xml
+++ b/nifi-nar-bundles/nifi-standard-services/nifi-hbase_1_1_2-client-service-bundle/pom.xml
@@ -82,6 +82,12 @@
                 <artifactId>hadoop-auth</artifactId>
                 <version>${hadoop.version}</version>
             </dependency>
+            <dependency>
+                <!-- Explicitly force Netty to 3.10.6 because versions prior to 3.9.0 had a CVE -->
+                <groupId>io.netty</groupId>
+                <artifactId>netty</artifactId>
+                <version>3.10.6.Final</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>
 </project>
diff --git a/nifi-toolkit/pom.xml b/nifi-toolkit/pom.xml
index 12eae22b0df6..dce61f1d3ec3 100644
--- a/nifi-toolkit/pom.xml
+++ b/nifi-toolkit/pom.xml
@@ -47,7 +47,14 @@
                     </exclusion>
                 </exclusions>
             </dependency>
+            <dependency>
+                <!-- Explicitly force Netty to 3.10.6 because versions prior to 3.9.0 had a CVE -->
+                <groupId>io.netty</groupId>
+                <artifactId>netty</artifactId>
+                <version>3.10.6.Final</version>
+            </dependency>
         </dependencies>
+
     </dependencyManagement>
     <dependencies>
         <dependency>

From 10ffbf859541b43a343fe9b5de1797ad223f44f9 Mon Sep 17 00:00:00 2001
From: thenatog <thenatog@gmail.com>
Date: Fri, 12 Oct 2018 14:35:05 -0400
Subject: [PATCH 2/4] NIFI-5665 - Changed netty versions to more closely match
 the original netty dependency version.

---
 nifi-nar-bundles/nifi-atlas-bundle/pom.xml            |  4 ++--
 .../nifi-extension-utils/nifi-record-utils/pom.xml    |  5 ++---
 nifi-nar-bundles/nifi-framework-bundle/pom.xml        |  4 ++--
 nifi-nar-bundles/nifi-hadoop-libraries-bundle/pom.xml |  4 ++--
 nifi-nar-bundles/nifi-hive-bundle/pom.xml             |  4 ++--
 nifi-nar-bundles/nifi-kafka-bundle/pom.xml            |  4 ++--
 .../nifi-kite-bundle/nifi-kite-processors/pom.xml     |  6 ------
 nifi-nar-bundles/nifi-kite-bundle/pom.xml             |  6 ++++++
 .../nifi-parquet-processors/pom.xml                   | 11 -----------
 nifi-nar-bundles/nifi-parquet-bundle/pom.xml          | 11 ++++++++++-
 nifi-nar-bundles/nifi-riemann-bundle/pom.xml          |  4 ++--
 nifi-nar-bundles/nifi-spark-bundle/pom.xml            |  4 ++--
 .../nifi-hbase_1_1_2-client-service-bundle/pom.xml    |  4 ++--
 nifi-toolkit/pom.xml                                  |  4 ++--
 14 files changed, 36 insertions(+), 39 deletions(-)

diff --git a/nifi-nar-bundles/nifi-atlas-bundle/pom.xml b/nifi-nar-bundles/nifi-atlas-bundle/pom.xml
index 5a9038dd4e53..d831f25a1dac 100644
--- a/nifi-nar-bundles/nifi-atlas-bundle/pom.xml
+++ b/nifi-nar-bundles/nifi-atlas-bundle/pom.xml
@@ -37,10 +37,10 @@
     <dependencyManagement>
         <dependencies>
             <dependency>
-                <!-- Explicitly force Netty to 3.10.6 because versions prior to 3.9.0 had a CVE -->
+                <!-- Explicitly force Netty to 3.7.1 due to CVE-2014-0193 -->
                 <groupId>io.netty</groupId>
                 <artifactId>netty</artifactId>
-                <version>3.10.6.Final</version>
+                <version>3.7.1.Final</version>
             </dependency>
             <dependency>
                 <groupId>org.apache.nifi</groupId>
diff --git a/nifi-nar-bundles/nifi-extension-utils/nifi-record-utils/pom.xml b/nifi-nar-bundles/nifi-extension-utils/nifi-record-utils/pom.xml
index 035f2ddd1b00..985b25f8a89f 100644
--- a/nifi-nar-bundles/nifi-extension-utils/nifi-record-utils/pom.xml
+++ b/nifi-nar-bundles/nifi-extension-utils/nifi-record-utils/pom.xml
@@ -33,12 +33,11 @@
     <dependencyManagement>
         <dependencies>
             <dependency>
-                <!-- Explicitly force Netty to 3.10.6 because versions prior to 3.9.0 had a CVE -->
+                <!-- Explicitly force Netty to 3.7.1 due to CVE-2014-0193 -->
                 <groupId>io.netty</groupId>
                 <artifactId>netty</artifactId>
-                <version>3.10.6.Final</version>
+                <version>3.7.1.Final</version>
             </dependency>
         </dependencies>
     </dependencyManagement>
-
 </project>
diff --git a/nifi-nar-bundles/nifi-framework-bundle/pom.xml b/nifi-nar-bundles/nifi-framework-bundle/pom.xml
index 06f4be074e9e..f0297f8d53e2 100644
--- a/nifi-nar-bundles/nifi-framework-bundle/pom.xml
+++ b/nifi-nar-bundles/nifi-framework-bundle/pom.xml
@@ -602,10 +602,10 @@
                 <version>3.6</version>
             </dependency>
             <dependency>
-                <!-- Explicitly force Netty to 3.10.6 because versions prior to 3.9.0 had a CVE -->
+                <!-- Explicitly force Netty to 3.7.1 due to CVE-2014-0193 -->
                 <groupId>io.netty</groupId>
                 <artifactId>netty</artifactId>
-                <version>3.10.6.Final</version>
+                <version>3.7.1.Final</version>
             </dependency>
         </dependencies>
     </dependencyManagement>
diff --git a/nifi-nar-bundles/nifi-hadoop-libraries-bundle/pom.xml b/nifi-nar-bundles/nifi-hadoop-libraries-bundle/pom.xml
index c4f72c3bb984..26e3750df672 100644
--- a/nifi-nar-bundles/nifi-hadoop-libraries-bundle/pom.xml
+++ b/nifi-nar-bundles/nifi-hadoop-libraries-bundle/pom.xml
@@ -29,10 +29,10 @@
     <dependencyManagement>
         <dependencies>
             <dependency>
-                <!-- Explicitly force Netty to 3.10.6 because versions prior to 3.9.0 had a CVE -->
+                <!-- Explicitly force Netty to 3.7.1 due to CVE-2014-0193 -->
                 <groupId>io.netty</groupId>
                 <artifactId>netty</artifactId>
-                <version>3.10.6.Final</version>
+                <version>3.7.1.Final</version>
             </dependency>
         </dependencies>
     </dependencyManagement>
diff --git a/nifi-nar-bundles/nifi-hive-bundle/pom.xml b/nifi-nar-bundles/nifi-hive-bundle/pom.xml
index 8bc55a7fbd94..eca835ab4681 100644
--- a/nifi-nar-bundles/nifi-hive-bundle/pom.xml
+++ b/nifi-nar-bundles/nifi-hive-bundle/pom.xml
@@ -38,10 +38,10 @@
     <dependencyManagement>
         <dependencies>
             <dependency>
-                <!-- Explicitly force Netty to 3.10.6 because versions prior to 3.9.0 had a CVE -->
+                <!-- Explicitly force Netty to 3.7.1 due to CVE-2014-0193 -->
                 <groupId>io.netty</groupId>
                 <artifactId>netty</artifactId>
-                <version>3.10.6.Final</version>
+                <version>3.7.1.Final</version>
             </dependency>
         </dependencies>
     </dependencyManagement>
diff --git a/nifi-nar-bundles/nifi-kafka-bundle/pom.xml b/nifi-nar-bundles/nifi-kafka-bundle/pom.xml
index f44e1e1d5666..8728fe1f51a5 100644
--- a/nifi-nar-bundles/nifi-kafka-bundle/pom.xml
+++ b/nifi-nar-bundles/nifi-kafka-bundle/pom.xml
@@ -78,10 +78,10 @@
                 <version>1.8.0-SNAPSHOT</version>
             </dependency>
             <dependency>
-                <!-- Explicitly force Netty to 3.10.6 because versions prior to 3.9.0 had a CVE -->
+                <!-- Explicitly force Netty to 3.7.1 due to CVE-2014-0193 -->
                 <groupId>io.netty</groupId>
                 <artifactId>netty</artifactId>
-                <version>3.10.6.Final</version>
+                <version>3.7.1.Final</version>
             </dependency>
         </dependencies>
     </dependencyManagement>
diff --git a/nifi-nar-bundles/nifi-kite-bundle/nifi-kite-processors/pom.xml b/nifi-nar-bundles/nifi-kite-bundle/nifi-kite-processors/pom.xml
index 22a2912eb925..20d5a245dc23 100644
--- a/nifi-nar-bundles/nifi-kite-bundle/nifi-kite-processors/pom.xml
+++ b/nifi-nar-bundles/nifi-kite-bundle/nifi-kite-processors/pom.xml
@@ -295,12 +295,6 @@
                 <artifactId>nifi-kite-processors</artifactId>
                 <version>1.8.0-SNAPSHOT</version>
             </dependency>
-            <dependency>
-                <!-- Explicitly force Netty to 3.10.6 because versions prior to 3.9.0 had a CVE -->
-                <groupId>io.netty</groupId>
-                <artifactId>netty</artifactId>
-                <version>3.10.6.Final</version>
-            </dependency>
     </dependencies>
     </dependencyManagement>
 
diff --git a/nifi-nar-bundles/nifi-kite-bundle/pom.xml b/nifi-nar-bundles/nifi-kite-bundle/pom.xml
index e566c2381f68..9911b8596030 100644
--- a/nifi-nar-bundles/nifi-kite-bundle/pom.xml
+++ b/nifi-nar-bundles/nifi-kite-bundle/pom.xml
@@ -38,6 +38,12 @@
                 <artifactId>nifi-kite-processors</artifactId>
                 <version>1.8.0-SNAPSHOT</version>
             </dependency>
+            <dependency>
+                <!-- Explicitly force Netty to 3.6.9 due to CVE-2014-0193 -->
+                <groupId>io.netty</groupId>
+                <artifactId>netty</artifactId>
+                <version>3.6.9.Final</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>
 
diff --git a/nifi-nar-bundles/nifi-parquet-bundle/nifi-parquet-processors/pom.xml b/nifi-nar-bundles/nifi-parquet-bundle/nifi-parquet-processors/pom.xml
index d5a7913286e0..c8aa0edb0607 100644
--- a/nifi-nar-bundles/nifi-parquet-bundle/nifi-parquet-processors/pom.xml
+++ b/nifi-nar-bundles/nifi-parquet-bundle/nifi-parquet-processors/pom.xml
@@ -82,17 +82,6 @@
             <scope>test</scope>
         </dependency>
     </dependencies>
-    <dependencyManagement>
-        <!-- Explicitly force Netty to 3.10.6 because versions prior to 3.9.0 had a CVE -->
-        <dependencies>
-            <dependency>
-                <groupId>io.netty</groupId>
-                <artifactId>netty</artifactId>
-                <version>3.10.6.Final</version>
-            </dependency>
-        </dependencies>
-    </dependencyManagement>
-
     <build>
         <plugins>
             <plugin>
diff --git a/nifi-nar-bundles/nifi-parquet-bundle/pom.xml b/nifi-nar-bundles/nifi-parquet-bundle/pom.xml
index 0ed219a59d12..ad80dc480073 100644
--- a/nifi-nar-bundles/nifi-parquet-bundle/pom.xml
+++ b/nifi-nar-bundles/nifi-parquet-bundle/pom.xml
@@ -31,5 +31,14 @@
         <module>nifi-parquet-processors</module>
         <module>nifi-parquet-nar</module>
     </modules>
-
+    <dependencyManagement>
+        <!-- Explicitly force Netty to 3.6.9 due to CVE-2014-0193 -->
+        <dependencies>
+            <dependency>
+                <groupId>io.netty</groupId>
+                <artifactId>netty</artifactId>
+                <version>3.6.9.Final</version>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
 </project>
diff --git a/nifi-nar-bundles/nifi-riemann-bundle/pom.xml b/nifi-nar-bundles/nifi-riemann-bundle/pom.xml
index c652aaf72326..42532f709aad 100644
--- a/nifi-nar-bundles/nifi-riemann-bundle/pom.xml
+++ b/nifi-nar-bundles/nifi-riemann-bundle/pom.xml
@@ -45,10 +45,10 @@
                 <version>1.8.0-SNAPSHOT</version>
             </dependency>
             <dependency>
-                <!-- Explicitly force Netty to 3.10.6 because versions prior to 3.9.0 had a CVE -->
+                <!-- Explicitly force Netty to 3.6.9 due to CVE-2014-0193 -->
                 <groupId>io.netty</groupId>
                 <artifactId>netty</artifactId>
-                <version>3.10.6.Final</version>
+                <version>3.6.9.Final</version>
             </dependency>
         </dependencies>
     </dependencyManagement>
diff --git a/nifi-nar-bundles/nifi-spark-bundle/pom.xml b/nifi-nar-bundles/nifi-spark-bundle/pom.xml
index 57e290368a17..99a64ec915bf 100644
--- a/nifi-nar-bundles/nifi-spark-bundle/pom.xml
+++ b/nifi-nar-bundles/nifi-spark-bundle/pom.xml
@@ -64,10 +64,10 @@
                 <version>1.19.1</version>
             </dependency>
             <dependency>
-                <!-- Explicitly force Netty to 3.10.6 because versions prior to 3.9.0 had a CVE -->
+                <!-- Explicitly force Netty to 3.8.2 due to CVE-2014-0193 -->
                 <groupId>io.netty</groupId>
                 <artifactId>netty</artifactId>
-                <version>3.10.6.Final</version>
+                <version>3.8.2.Final</version>
             </dependency>
         </dependencies>
     </dependencyManagement>
diff --git a/nifi-nar-bundles/nifi-standard-services/nifi-hbase_1_1_2-client-service-bundle/pom.xml b/nifi-nar-bundles/nifi-standard-services/nifi-hbase_1_1_2-client-service-bundle/pom.xml
index abb3075554cd..c428f1231c2f 100644
--- a/nifi-nar-bundles/nifi-standard-services/nifi-hbase_1_1_2-client-service-bundle/pom.xml
+++ b/nifi-nar-bundles/nifi-standard-services/nifi-hbase_1_1_2-client-service-bundle/pom.xml
@@ -83,10 +83,10 @@
                 <version>${hadoop.version}</version>
             </dependency>
             <dependency>
-                <!-- Explicitly force Netty to 3.10.6 because versions prior to 3.9.0 had a CVE -->
+                <!-- Explicitly force Netty to 3.6.9 due to CVE-2014-0193 -->
                 <groupId>io.netty</groupId>
                 <artifactId>netty</artifactId>
-                <version>3.10.6.Final</version>
+                <version>3.6.9.Final</version>
             </dependency>
         </dependencies>
     </dependencyManagement>
diff --git a/nifi-toolkit/pom.xml b/nifi-toolkit/pom.xml
index dce61f1d3ec3..dee8b96bed5a 100644
--- a/nifi-toolkit/pom.xml
+++ b/nifi-toolkit/pom.xml
@@ -48,10 +48,10 @@
                 </exclusions>
             </dependency>
             <dependency>
-                <!-- Explicitly force Netty to 3.10.6 because versions prior to 3.9.0 had a CVE -->
+                <!-- Explicitly force Netty to 3.7.1 due to CVE-2014-0193 -->
                 <groupId>io.netty</groupId>
                 <artifactId>netty</artifactId>
-                <version>3.10.6.Final</version>
+                <version>3.7.1.Final</version>
             </dependency>
         </dependencies>
 

From b92dfb74683dcfa8ab99bbac3b8ed5df7b2c2337 Mon Sep 17 00:00:00 2001
From: thenatog <thenatog@gmail.com>
Date: Fri, 12 Oct 2018 15:03:02 -0400
Subject: [PATCH 3/4] NIFI-5665 - Fixed version for nifi-spark-bundle.

---
 nifi-nar-bundles/nifi-spark-bundle/pom.xml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nifi-nar-bundles/nifi-spark-bundle/pom.xml b/nifi-nar-bundles/nifi-spark-bundle/pom.xml
index 99a64ec915bf..70b569afc333 100644
--- a/nifi-nar-bundles/nifi-spark-bundle/pom.xml
+++ b/nifi-nar-bundles/nifi-spark-bundle/pom.xml
@@ -64,10 +64,10 @@
                 <version>1.19.1</version>
             </dependency>
             <dependency>
-                <!-- Explicitly force Netty to 3.8.2 due to CVE-2014-0193 -->
+                <!-- Explicitly force Netty to 3.7.1 due to CVE-2014-0193 -->
                 <groupId>io.netty</groupId>
                 <artifactId>netty</artifactId>
-                <version>3.8.2.Final</version>
+                <version>3.7.1.Final</version>
             </dependency>
         </dependencies>
     </dependencyManagement>

From 556f2b51be42d64031107b6a4e2a8e39146a988c Mon Sep 17 00:00:00 2001
From: thenatog <thenatog@gmail.com>
Date: Fri, 12 Oct 2018 15:22:03 -0400
Subject: [PATCH 4/4] NIFI-5665 - Fixing copy and paste error.

---
 .../nifi-kite-bundle/nifi-kite-processors/pom.xml      | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/nifi-nar-bundles/nifi-kite-bundle/nifi-kite-processors/pom.xml b/nifi-nar-bundles/nifi-kite-bundle/nifi-kite-processors/pom.xml
index 20d5a245dc23..0ff664a953c3 100644
--- a/nifi-nar-bundles/nifi-kite-bundle/nifi-kite-processors/pom.xml
+++ b/nifi-nar-bundles/nifi-kite-bundle/nifi-kite-processors/pom.xml
@@ -288,16 +288,6 @@
 
     </dependencies>
 
-    <dependencyManagement>
-        <dependencies>
-            <dependency>
-                <groupId>org.apache.nifi</groupId>
-                <artifactId>nifi-kite-processors</artifactId>
-                <version>1.8.0-SNAPSHOT</version>
-            </dependency>
-    </dependencies>
-    </dependencyManagement>
-
     <build>
         <plugins>
             <plugin>