I noticed that a new version of glibc is available in cssu-devel.

Glibc also includes the (outdated) timezone files.
When I asked Freemangordon about updating timezone files, he said that he considered it (kind of) equally important as updating the certificates. But as long as glibc was not in cssu, no action would be taken.

That argument is now no longer valid...