Release notes for Safe Exam Browser version 3.7.1 for macOS:
SEB 3.7.1 adds the option to require specific SEB client versions in a configuration, allows fetching server certificates by URL in settings, and contains a security fix for certificate validation as well as several permission-handling and stability fixes.
New in SEB 3.7.1b1 (Build 1598E)
-
Added "Allowed SEB Versions": exam administrators can now require that a configuration may only be used (and an exam only attempted) with one or more specific SEB client version(s). If the SEB version running on the device doesn't match the requirement, SEB displays an alert stating which version(s) are required and offers to open the SEB download page ("Download SEB") or to quit; in both cases SEB is quit, so it can't be used for the exam with a disallowed version. The requirements are configured in Settings / Security (see the new setting sebAllowedVersions below).
As this feature will only make sense when there will only be SEB macOS clients circulating which support the version check and because that is more secure, you should preferably use server-side SEB client version restrictions. -
Added fetching server certificates by URL in Settings / Network / Certificates: certificates to embed can now be retrieved directly from a URL.
-
Fixed improper certificate validation (CWE-295): removed the "authorized hosts" substring fallback in the server-trust evaluation, which could accept a certificate for a host whose name merely contained an authorized host name as a substring. Server trust is now matched correctly.
-
Fixed a crash when opening the Advanced Certificates sheet in Settings / Network / Certificates.
-
Fixed Full Disk Access permission detection on macOS 12 and 11. System permission prompts are now requested while the AAC Assessment Mode is off, and Full Disk Access is checked before requesting download/log folder access, so the prompts are shown reliably and aren't hidden behind the locked-down UI. Also the authorization dialog is no longer displayed when starting SEB with pressed option key (which displays Settings instead of starting a session).
-
Location Services access is now only requested when actually needed (to display Wi-Fi network names), when displaying the Wi-Fi control isn’t disabled and while SEB isn't locked down, so users aren't prompted unnecessarily.
-
Replaced the preset permitted process for the Cisco Secure Client with AnyConnect, which works when it is connected before starting SEB.
New Settings
sebAllowedVersions — Array of strings, default empty (no restriction)
Settings window: Security → "Allowed SEB Versions"
Specifies one or more SEB client versions required in order to use a configuration. Enter one restriction per row. Each restriction has the format OS.Major.Minor.[Patch].[Build].[AE].[min], where the parts in square brackets are optional:
OS— the operating system:Win,MacoriOS.Major,Minor— the major and minor version (required).[Patch],[Build]— optionally the patch and build version.[AE]— optionally indicates the Alliance Edition.[min]— optionally marks the value as the minimum required version (this version or any newer one); without it, the restriction is an exact match on the components you specified.
Examples: Win.3.9.min allows all SEB for Windows versions from 3.9 upwards; Mac.3.7.1 requires exactly SEB for macOS 3.7.1.
Only restrictions for the platform SEB is running on can allow the current build; a non-empty list that contains no satisfiable restriction for the running platform blocks it. When the running version isn't allowed, SEB shows an error message describing the requirement — phrased as a minimum ("… or higher") or as one or more specific versions, as configured — with a link to the SEB download page.