Jenkins Security Advisory SECURITY-155 notes: "Plugin binaries used by Jenkins can be downloaded by users who shouldn't have that access."
Acknowledgements: Red Hat would like to thank the Jenkins project for reporting this issue. Upstream acknowledges Jesse Glick as the original reporter.
Public now: https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01
This issue has been addressed in the following products: Red Hat OpenShift Enterprise 2.1 Via RHBA-2014:1630 https://rhn.redhat.com/errata/RHBA-2014-1630.html
This issue has been addressed in the following products: RHEL 7 Version of OpenShift Enterprise 3.1 Via RHSA-2016:0070 https://access.redhat.com/errata/RHSA-2016:0070