A high severity vulnerability (CVE-2021-44228) for Apache Log4j 2 versions 2.0 to 2.14 was disclosed publicly on the project’s GitHub on December 9, 2021.

For information about affected Elasticsearch versions and mitigation steps, see our related security announcement.

Painless: Any Painless script where a method call resolves a lambda argument to a UnaryOperator or a BinaryOperator type results in an IllegalArgumentException. This exception results in a compilation error when static types are used, or a runtime error for dynamic types. Use standard procedural statements as a workaround, such as if/else, while, and for statements.

The following example is a UnaryOperator type that will result in a failure:

List l = ['abc', '123']; l.replaceAll(f -> f.replace('abc', 'doremi');

The following example is a possible workaround:

List l = ['abc', '123'];
for (int i = 0; i < l.size(); ++i) {
    l.set(i, l.get(i).replace('abc', 'doremi'));
}