CVE-2021-27204: 
NixOS vulnerability analysis and mitigation

Telegram before version 7.4 (212543) Stable on macOS contained a security vulnerability (CVE-2021-27204) where the application stored the local passcode in cleartext. This vulnerability was discovered and reported in February 2021, affecting the macOS version of the Telegram messaging application (NVD, Input Zero).

The vulnerability was identified as a cleartext storage of sensitive information (CWE-312). The issue specifically involved the storage of local passcodes used to unlock the application in plaintext format within the Users/[username]/Library/Group Containers/6N38VWS5BX.ru.keepcoder.Telegram/accounts-metadata JSON file. The vulnerability received a CVSS v3.1 Base Score of 5.5 (MEDIUM) and a CVSS v2.0 Base Score of 2.1 (LOW) (NVD).

The vulnerability could lead to information disclosure, potentially allowing unauthorized access to user passcodes if an attacker gained access to the affected system. The exposure of cleartext passcodes could compromise the security of user accounts and their associated data (Cyber Security News).

The vulnerability required local access to the affected system to exploit. An attacker would need to access the specific file path where the passcode was stored in cleartext to obtain the sensitive information (NVD).

The vulnerability was patched in Telegram version 7.4 (212543) Stable for macOS. Users were advised to update to this version or later to address the security issue. The security researcher who discovered the vulnerability was awarded a bounty of 3000 euros for reporting the issue (Input Zero).