When a check-update is performed on the Security Analytics UI it does not pick up python-backport-ssl_match_hostname.noarch for update. However, doing a yum check-update at the command-line finds that rpm as available for update.
This is related to a known issue with puppet, which is tracked in the ticket PUP-3861..
The steps below can be performed as a workaround:
Check updates from UI.. It provides you with updates..
Update from UI.
Reboot after the upgrade.
Check for updates again from the UI and you will notice an even newer package