- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
The `manzana` crate appears to be a work-in-progress module for the Apple Silicon chips' features, including the Secure Enclave.
This crate's description and `README`s make no hint at the fact that the [`SecureEnclaveSigner`](https://docs.rs/manzana/0.2.0/manzana/secure_enclave/struct.SecureEnclaveSigner.html) type is a stubbed implementation that does not actually perform any cryptographic operations, and instead returns fixed values.
Unsuspecting users of the crate, who may not check the source code, receive no warning about this and may believe they are using a secure implementation when they are not.
There are currently (as of `2026-04-07`) no versions of the crate that contain either a real implementation, or a warning about the stubbed cryptography.
Patch / fix
- crates.io manzana 0.3.0
Is RUSTSEC-2026-0273 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerAffected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | manzana | >=0.0.0-0, <0.3.0 |
0.3.0 |
References
-
crates.io
/crates/manzana
package
-
rustsec.org
/advisories/RUSTSEC-2026-0273.html
advisory
-
github.com
/paiml/manzana/issues/3
report
-
github.com
/paiml/manzana/blob/89e3183ac38088d418a2edeb9d3e0f35133b27a3/README.md
web
-
github.com
/paiml/manzana/blob/89e3183ac38088d418a2edeb9d3e0f35133b27a3/src/secure_enclave.rs#L312
web
-
github.com
/paiml/manzana/blob/89e3183ac38088d418a2edeb9d3e0f35133b27a3/src/secure_enclave.rs#L352
web
Sources
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.