Why does a Red Hat Product Advisory for a CVE show a higher version than what is currently marked as "latest"?

Issue

• A Red Hat Product Advisory shows that a package with a lesser version number is more current than a higher version number
• A security scanning tool says a CVE was not patched because the version of an installed package is lesser than Red Hat's version published in the CVE's corresponding Red Hat Product Advisory