From 5eb5e96b1621d87bf8cca96d18a2c36177a1f54e Mon Sep 17 00:00:00 2001
From: thenatog <thenatog@gmail.com>
Date: Mon, 8 Oct 2018 12:58:20 -0400
Subject: [PATCH] NIFI-5665 - Changed netty versions to more closely match the
 original netty dependency version. NIFI-5665 - Fixed version for
 nifi-spark-bundle. NIFI-5665 - Fixing copy and paste error.

This closes #3067
---
 nifi-nar-bundles/nifi-atlas-bundle/pom.xml            |  6 ++++++
 .../nifi-extension-utils/nifi-record-utils/pom.xml    | 10 ++++++++++
 nifi-nar-bundles/nifi-framework-bundle/pom.xml        |  6 ++++++
 nifi-nar-bundles/nifi-hadoop-libraries-bundle/pom.xml | 10 ++++++++++
 nifi-nar-bundles/nifi-hive-bundle/pom.xml             | 11 +++++++++++
 nifi-nar-bundles/nifi-kafka-bundle/pom.xml            |  6 ++++++
 nifi-nar-bundles/nifi-kite-bundle/pom.xml             |  6 ++++++
 .../nifi-parquet-processors/pom.xml                   |  1 -
 nifi-nar-bundles/nifi-parquet-bundle/pom.xml          | 11 ++++++++++-
 nifi-nar-bundles/nifi-riemann-bundle/pom.xml          |  6 ++++++
 nifi-nar-bundles/nifi-spark-bundle/pom.xml            |  7 ++++++-
 .../nifi-hbase_1_1_2-client-service-bundle/pom.xml    |  6 ++++++
 nifi-toolkit/pom.xml                                  |  7 +++++++
 13 files changed, 90 insertions(+), 3 deletions(-)

diff --git a/nifi-nar-bundles/nifi-atlas-bundle/pom.xml b/nifi-nar-bundles/nifi-atlas-bundle/pom.xml
index e4db5a651f..d831f25a1d 100644
--- a/nifi-nar-bundles/nifi-atlas-bundle/pom.xml
+++ b/nifi-nar-bundles/nifi-atlas-bundle/pom.xml
@@ -36,6 +36,12 @@
 
     <dependencyManagement>
         <dependencies>
+            <dependency>
+                <!-- Explicitly force Netty to 3.7.1 due to CVE-2014-0193 -->
+                <groupId>io.netty</groupId>
+                <artifactId>netty</artifactId>
+                <version>3.7.1.Final</version>
+            </dependency>
             <dependency>
                 <groupId>org.apache.nifi</groupId>
                 <artifactId>nifi-atlas-reporting-task</artifactId>
diff --git a/nifi-nar-bundles/nifi-extension-utils/nifi-record-utils/pom.xml b/nifi-nar-bundles/nifi-extension-utils/nifi-record-utils/pom.xml
index d516ba4e88..985b25f8a8 100644
--- a/nifi-nar-bundles/nifi-extension-utils/nifi-record-utils/pom.xml
+++ b/nifi-nar-bundles/nifi-extension-utils/nifi-record-utils/pom.xml
@@ -30,4 +30,14 @@
 	<module>nifi-mock-record-utils</module>
     </modules>
 
+    <dependencyManagement>
+        <dependencies>
+            <dependency>
+                <!-- Explicitly force Netty to 3.7.1 due to CVE-2014-0193 -->
+                <groupId>io.netty</groupId>
+                <artifactId>netty</artifactId>
+                <version>3.7.1.Final</version>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
 </project>
diff --git a/nifi-nar-bundles/nifi-framework-bundle/pom.xml b/nifi-nar-bundles/nifi-framework-bundle/pom.xml
index 77de2db037..f0297f8d53 100644
--- a/nifi-nar-bundles/nifi-framework-bundle/pom.xml
+++ b/nifi-nar-bundles/nifi-framework-bundle/pom.xml
@@ -601,6 +601,12 @@
                 <artifactId>commons-net</artifactId>
                 <version>3.6</version>
             </dependency>
+            <dependency>
+                <!-- Explicitly force Netty to 3.7.1 due to CVE-2014-0193 -->
+                <groupId>io.netty</groupId>
+                <artifactId>netty</artifactId>
+                <version>3.7.1.Final</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>
 </project>
diff --git a/nifi-nar-bundles/nifi-hadoop-libraries-bundle/pom.xml b/nifi-nar-bundles/nifi-hadoop-libraries-bundle/pom.xml
index 77716eedee..26e3750df6 100644
--- a/nifi-nar-bundles/nifi-hadoop-libraries-bundle/pom.xml
+++ b/nifi-nar-bundles/nifi-hadoop-libraries-bundle/pom.xml
@@ -26,4 +26,14 @@
     <modules>
         <module>nifi-hadoop-libraries-nar</module>
     </modules>
+    <dependencyManagement>
+        <dependencies>
+            <dependency>
+                <!-- Explicitly force Netty to 3.7.1 due to CVE-2014-0193 -->
+                <groupId>io.netty</groupId>
+                <artifactId>netty</artifactId>
+                <version>3.7.1.Final</version>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
 </project>
diff --git a/nifi-nar-bundles/nifi-hive-bundle/pom.xml b/nifi-nar-bundles/nifi-hive-bundle/pom.xml
index c67a267755..eca835ab46 100644
--- a/nifi-nar-bundles/nifi-hive-bundle/pom.xml
+++ b/nifi-nar-bundles/nifi-hive-bundle/pom.xml
@@ -35,6 +35,17 @@
         <module>nifi-hive3-nar</module>
     </modules>
 
+    <dependencyManagement>
+        <dependencies>
+            <dependency>
+                <!-- Explicitly force Netty to 3.7.1 due to CVE-2014-0193 -->
+                <groupId>io.netty</groupId>
+                <artifactId>netty</artifactId>
+                <version>3.7.1.Final</version>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
+
     <properties>
         <hive.version>1.2.1</hive.version>
         <hive.hadoop.version>2.6.2</hive.hadoop.version>
diff --git a/nifi-nar-bundles/nifi-kafka-bundle/pom.xml b/nifi-nar-bundles/nifi-kafka-bundle/pom.xml
index 04790c8995..8728fe1f51 100644
--- a/nifi-nar-bundles/nifi-kafka-bundle/pom.xml
+++ b/nifi-nar-bundles/nifi-kafka-bundle/pom.xml
@@ -77,6 +77,12 @@
                 <artifactId>nifi-kafka-2-0-processors</artifactId>
                 <version>1.8.0-SNAPSHOT</version>
             </dependency>
+            <dependency>
+                <!-- Explicitly force Netty to 3.7.1 due to CVE-2014-0193 -->
+                <groupId>io.netty</groupId>
+                <artifactId>netty</artifactId>
+                <version>3.7.1.Final</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>
 </project>
diff --git a/nifi-nar-bundles/nifi-kite-bundle/pom.xml b/nifi-nar-bundles/nifi-kite-bundle/pom.xml
index e566c2381f..9911b85960 100644
--- a/nifi-nar-bundles/nifi-kite-bundle/pom.xml
+++ b/nifi-nar-bundles/nifi-kite-bundle/pom.xml
@@ -38,6 +38,12 @@
                 <artifactId>nifi-kite-processors</artifactId>
                 <version>1.8.0-SNAPSHOT</version>
             </dependency>
+            <dependency>
+                <!-- Explicitly force Netty to 3.6.9 due to CVE-2014-0193 -->
+                <groupId>io.netty</groupId>
+                <artifactId>netty</artifactId>
+                <version>3.6.9.Final</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>
 
diff --git a/nifi-nar-bundles/nifi-parquet-bundle/nifi-parquet-processors/pom.xml b/nifi-nar-bundles/nifi-parquet-bundle/nifi-parquet-processors/pom.xml
index 57eed83f90..c8aa0edb06 100644
--- a/nifi-nar-bundles/nifi-parquet-bundle/nifi-parquet-processors/pom.xml
+++ b/nifi-nar-bundles/nifi-parquet-bundle/nifi-parquet-processors/pom.xml
@@ -82,7 +82,6 @@
             <scope>test</scope>
         </dependency>
     </dependencies>
-
     <build>
         <plugins>
             <plugin>
diff --git a/nifi-nar-bundles/nifi-parquet-bundle/pom.xml b/nifi-nar-bundles/nifi-parquet-bundle/pom.xml
index 0ed219a59d..ad80dc4800 100644
--- a/nifi-nar-bundles/nifi-parquet-bundle/pom.xml
+++ b/nifi-nar-bundles/nifi-parquet-bundle/pom.xml
@@ -31,5 +31,14 @@
         <module>nifi-parquet-processors</module>
         <module>nifi-parquet-nar</module>
     </modules>
-
+    <dependencyManagement>
+        <!-- Explicitly force Netty to 3.6.9 due to CVE-2014-0193 -->
+        <dependencies>
+            <dependency>
+                <groupId>io.netty</groupId>
+                <artifactId>netty</artifactId>
+                <version>3.6.9.Final</version>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
 </project>
diff --git a/nifi-nar-bundles/nifi-riemann-bundle/pom.xml b/nifi-nar-bundles/nifi-riemann-bundle/pom.xml
index 8f0f8b22a1..42532f709a 100644
--- a/nifi-nar-bundles/nifi-riemann-bundle/pom.xml
+++ b/nifi-nar-bundles/nifi-riemann-bundle/pom.xml
@@ -44,6 +44,12 @@
                 <artifactId>nifi-riemann-processors</artifactId>
                 <version>1.8.0-SNAPSHOT</version>
             </dependency>
+            <dependency>
+                <!-- Explicitly force Netty to 3.6.9 due to CVE-2014-0193 -->
+                <groupId>io.netty</groupId>
+                <artifactId>netty</artifactId>
+                <version>3.6.9.Final</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>
 </project>
\ No newline at end of file
diff --git a/nifi-nar-bundles/nifi-spark-bundle/pom.xml b/nifi-nar-bundles/nifi-spark-bundle/pom.xml
index 322b11238a..70b569afc3 100644
--- a/nifi-nar-bundles/nifi-spark-bundle/pom.xml
+++ b/nifi-nar-bundles/nifi-spark-bundle/pom.xml
@@ -63,6 +63,12 @@
                 <artifactId>jersey-client</artifactId>
                 <version>1.19.1</version>
             </dependency>
+            <dependency>
+                <!-- Explicitly force Netty to 3.7.1 due to CVE-2014-0193 -->
+                <groupId>io.netty</groupId>
+                <artifactId>netty</artifactId>
+                <version>3.7.1.Final</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>
 
@@ -81,6 +87,5 @@
             <artifactId>nifi-processor-utils</artifactId>
             <version>1.8.0-SNAPSHOT</version>
         </dependency>
-
     </dependencies>
 </project>
\ No newline at end of file
diff --git a/nifi-nar-bundles/nifi-standard-services/nifi-hbase_1_1_2-client-service-bundle/pom.xml b/nifi-nar-bundles/nifi-standard-services/nifi-hbase_1_1_2-client-service-bundle/pom.xml
index 0b16b4742a..c428f1231c 100644
--- a/nifi-nar-bundles/nifi-standard-services/nifi-hbase_1_1_2-client-service-bundle/pom.xml
+++ b/nifi-nar-bundles/nifi-standard-services/nifi-hbase_1_1_2-client-service-bundle/pom.xml
@@ -82,6 +82,12 @@
                 <artifactId>hadoop-auth</artifactId>
                 <version>${hadoop.version}</version>
             </dependency>
+            <dependency>
+                <!-- Explicitly force Netty to 3.6.9 due to CVE-2014-0193 -->
+                <groupId>io.netty</groupId>
+                <artifactId>netty</artifactId>
+                <version>3.6.9.Final</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>
 </project>
diff --git a/nifi-toolkit/pom.xml b/nifi-toolkit/pom.xml
index 12eae22b0d..dee8b96bed 100644
--- a/nifi-toolkit/pom.xml
+++ b/nifi-toolkit/pom.xml
@@ -47,7 +47,14 @@
                     </exclusion>
                 </exclusions>
             </dependency>
+            <dependency>
+                <!-- Explicitly force Netty to 3.7.1 due to CVE-2014-0193 -->
+                <groupId>io.netty</groupId>
+                <artifactId>netty</artifactId>
+                <version>3.7.1.Final</version>
+            </dependency>
         </dependencies>
+
     </dependencyManagement>
     <dependencies>
         <dependency>