CVE-2021-27351: 
NixOS vulnerability analysis and mitigation

The Terminate Session feature in the Telegram application through 7.2.1 for Android, and through 2.4.7 for Windows and UNIX, fails to invalidate a recently active session. This vulnerability was assigned CVE-2021-27351 and was discovered in February 2021. The issue affects multiple versions of Telegram across different platforms including Android (versions up to 7.2.1) and Desktop versions for Windows and UNIX (versions up to 2.4.7) (NVD, Gentoo Advisory).

The vulnerability is classified as an Insufficient Session Expiration issue (CWE-613). It received a CVSS v3.1 Base Score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating that it can be exploited over the network with low attack complexity and requires no privileges or user interaction (NVD).

The vulnerability allows an attacker to potentially maintain access to a session that should have been terminated, compromising the security of the user's Telegram account. This could lead to unauthorized access to user communications and account features (NVD).

The vulnerability can be exploited remotely without requiring authentication. The attack complexity is rated as low, indicating that the conditions required for exploitation are fairly straightforward (NVD).

Users are advised to upgrade to Telegram versions newer than 7.2.1 for Android and 2.4.7 for Windows and UNIX platforms. For Gentoo Linux users specifically, the fix is available in version 2.4.11 and later of both telegram-desktop and telegram-desktop-bin packages (Gentoo Advisory).