[Security] update browserify-sign to the latest about crypto-browserify HOT 3 CLOSED

Semgrep also calls this out with the following information:

Affected versions of browserify-sign are vulnerable to Improper Verification Of Cryptographic Signature. The vulnerability lies in the checkValue function incorrectly verifying the upper bounds of the r and s components in a signature, enabling attackers to manipulate the s component by setting it to the prime number q, thereby simulating a zero value for s and potentially resulting in the unauthorized acceptance of maliciously signed messages during signature verification.

from crypto-browserify.

@mkilpatrick that sounds like something different - if elliptic has a vulnerability, then that package needs to fix it. The CVE you reference was fixed in browserify-sign 4-5 months ago (browserify/browserify-sign@85994cd) and is in v4.2.2 of that package.

from crypto-browserify.

if elliptic has a vulnerability, then that package needs to fix it - if there's a specific CVE, please link it.

from crypto-browserify.