> I don't remember having seen any professional security audit for dnsmasq before. Mozilla ("Secure Open Source" [0]) funded an audit of dnsmasq [1] by Cure53

> I don't remember having seen any professional security audit for dnsmasq before. Mozilla ("Secure Open Source" [0]) funded an audit of dnsmasq [1] by Cure53 [2] about a year and a half ago. The final report [3] (PDF) lists one "medium" and five "low" issues. It just goes to show that a "successful" audit (i.e., one that doesn't find any major/critical issues) ultimately doesn't prove much of anything at all WRT the overall security of a piece of software. [0]: https://wiki.mozilla.org/MOSS/Secure_Open_Source https://wiki.mozilla.org/MOSS/Secure_Open_Source [1]: https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#dnsmasq https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#d... [2]: https://cure53.de/ https://cure53.de/ [3]: https://wiki.mozilla.org/images/f/f7/Dnsmasq-report.pdf https://wiki.mozilla.org/images/f/f7/Dnsmasq-report.pdf