CVE-2021-36769: 
NixOS vulnerability analysis and mitigation

A reordering issue was discovered in Telegram affecting multiple versions: Android before 7.8.1, iOS before 7.8.3, and Desktop before 2.8.8. The vulnerability was disclosed on July 16, 2021. This vulnerability allows an attacker to manipulate the order in which messages are received by the server compared to how they were sent by the client (NVD, CVE).

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. This indicates that the vulnerability can be exploited over the network, requires low attack complexity, needs no privileges, and requires no user interaction. The impact primarily affects message integrity without compromising confidentiality or availability (NVD).

The vulnerability allows an attacker on the network to reorder messages coming from a client to the server. For example, this could allow altering the sequence of messages to change their meaning or context. This attack is described as trivial to carry out (MTProto Analysis).

The vulnerability has been addressed in the following versions: Telegram Android 7.8.1, Telegram iOS 7.8.3, and Telegram Desktop 2.8.8. Users should update to these versions or later to mitigate the vulnerability (MTProto Analysis).