Apache Hadoop 1.0
Apache Hadoop 1.0
The Apache Hadoop 1.0 reached end of service life on Oct 12, 2012 — Apache Hadoop no longer ships security patches or fixes for it. Our third-party support keeps it safe to run: 24/7 engineers manage issues, remediate vulnerabilities, and help you maintain compliance.
24/7 engineers own your Apache Hadoop 1.0 incidents end to end.
Mitigation and patch-around guidance when the vendor no longer ships fixes.
Controls evidence and documentation that keep auditors satisfied.
Specifications
- product
- apache-hadoop
- release
- 1.0
- product Label
- Apache Hadoop
- release Label
- 1.0
- codename
- lts
- latest Version
- 1.0.4
- release Date
- 2011-12-27
- maintained
- source Url
- https://endoflife.date/apache-hadoop
Lifecycle Dates
- End of Service Life
- Oct 12, 2012
- Last OEM Support
- Oct 12, 2012
OEM vs. 3rd Party Support
See how third-party support compares to the vendor contract for Apache Hadoop 1.0 — monitoring, break/fix, vulnerability work, operations and compliance, before and after EOSL.
| Feature | OEM Support | 3rd Party Support |
|---|---|---|
| Post-EOSL Support | ||
| Break/Fix Support | Until EOSL | |
| 24/7 Monitoring | ||
| Vulnerability Scanning & Remediation | ||
| Managed Operations | ||
| Procedure & Configuration Review | ||
| Compliance & Audit Documentation | Limited | |
| Discounted Migration to Other Platforms |
Why Choose 3rd Party Support for Apache Hadoop 1.0?
Vulnerability Remediation
Scanning, mitigation and patch-around guidance for Apache Hadoop 1.0 when the vendor no longer ships fixes.
Compliance Maintenance
Procedure review, controls evidence and the documentation auditors ask for — maintained continuously, not scrambled at audit time.
24/7 Expert Support
Engineers who know this release monitor, manage and fix issues around the clock — break/fix to managed operations.
Apache Hadoop 1.0 Support: Frequently Asked Questions
Is the Apache Hadoop 1.0 still supported?
Apache Hadoop ended support for the Apache Hadoop 1.0 on Oct 12, 2012 — no more patches or fixes from the vendor. Third-party support keeps it covered: our engineers manage issues, remediate vulnerabilities, and help you maintain compliance for as long as you run it.
When is the Apache Hadoop 1.0 end of service life (EOSL) date?
Apache Hadoop lists the end of service life for the Apache Hadoop 1.0 as Oct 12, 2012.
Can I keep using the Apache Hadoop 1.0 after its EOSL date?
Yes. EOSL means Apache Hadoop stops issuing patches and support — the software itself keeps running. Third-party support covers it from there: issue management, security vulnerability remediation, and the compliance documentation auditors ask for, for as long as you choose to run it.
How much does third-party support for the Apache Hadoop 1.0 cost?
Typically 40-70% below the OEM maintenance renewal price. Exact pricing depends on quantity, service level and location — request a quote and we respond within 24 hours.
Known Vulnerabilities Affecting Apache Hadoop 1.0
9 published CVEs affect the Apache Hadoop 1.0, including 4 rated critical or high severity. Apache Hadoop no longer ships security patches for this release — our engineers provide mitigation guidance, workarounds and hardening support.
| CVE | Severity | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2022-26612 | CRITICAL | 9.8 | Apr 7, 2022 | In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes. As a result, a TAR entry may create a symlink under the expected extraction directory which points to an external directory. A subsequent TAR entry may extract an arbitrary file into the external directory using the symlink name. This however would be caught by the same targetDirPath check on Unix because of the getCanonicalPath call. However on Windows, getCanonicalP |
| CVE-2012-4449 | CRITICAL | 9.8 | Oct 30, 2017 | Apache Hadoop before 0.23.4, 1.x before 1.0.4, and 2.x before 2.0.2 generate token passwords using a 20-bit secret when Kerberos security features are enabled, which makes it easier for context-dependent attackers to crack secret keys via a brute-force attack. |
| CVE-2012-2945 | HIGH | 7.5 | Oct 29, 2019 | Hadoop 1.0.3 contains a symlink vulnerability. |
| CVE-2017-3162 | HIGH | 7.3 | Apr 26, 2017 | HDFS clients interact with a servlet on the DataNode to browse the HDFS namespace. The NameNode is provided as a query parameter that is not validated in Apache Hadoop before 2.7.0. |
| CVE-2012-1574 | MEDIUM | 6.5 | Apr 12, 2012 | The Kerberos/MapReduce security functionality in Apache Hadoop 0.20.203.0 through 0.20.205.0, 0.23.x before 0.23.2, and 1.0.x before 1.0.2, as used in Cloudera CDH CDH3u0 through CDH3u2, Cloudera hadoop-0.20-sbin before 0.20.2+923.197, and other products, allows remote authenticated users to impersonate arbitrary cluster user accounts via unspecified vectors. |
| CVE-2024-23454 | MEDIUM | 6.2 | Sep 25, 2024 | Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local users may be able to view the content. This is because, on unix-like systems, the system temporary directory is shared between all local users. As such, files written in this directory, without setting the correct posix permissions explicitly, may be viewable by all other local users. |
| CVE-2017-3161 | MEDIUM | 6.1 | Apr 26, 2017 | The HDFS web UI in Apache Hadoop before 2.7.0 is vulnerable to a cross-site scripting (XSS) attack through an unescaped query parameter. |
| CVE-2016-5001 | MEDIUM | 5.5 | Aug 30, 2017 | This is an information disclosure vulnerability in Apache Hadoop before 2.6.4 and 2.7.x before 2.7.2 in the short-circuit reads feature of HDFS. A local user on an HDFS DataNode may be able to craft a block token that grants unauthorized read access to random files by guessing certain fields in the token. |
| CVE-2013-2192 | LOW | 3.2 | Jan 24, 2014 | The RPC protocol implementation in Apache Hadoop 2.x before 2.0.6-alpha, 0.23.x before 0.23.9, and 1.x before 1.2.1, when the Kerberos security features are enabled, allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information by forcing a downgrade to simple authentication. |