Description of problem:
When the --advisory flag is used on an upgrade or update command, the package version corresponding to the advisory ID is not the one selected for installation. The latest available package version matching the package name listed in the advisory is installed instead.

This functionality differs from that detailed in the RH documentation: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/managing_and_monitoring_security_updates/installing-security-updates_managing-and-monitoring-security-updates.

Version-Release number of selected component (if applicable):
dnf-4.7.0-16.el8_8.noarch

How reproducible:
Consistently

Steps to Reproduce:
1. Install a prior version of firefox (or any other package with security updates).
dnf downgrade firefox-60.5.1-1.el8.x86_64

2. List applicable advisories
dnf updateinfo list firefox

3. Select an advisory which is older than the latest. For this example, RHSA-2020:3832 for Firefox version firefox-78.3.0-1.el8_2.x86_64. Attempt to upgrade.
dnf update --advisory RHSA-2020:3832

Actual results:
Firefox version 102.14.0-1.el8_8 is selected for upgrade instead of 78.

Upgrading:
firefox x86_64 102.14.0-1.el8_8 rhel-8-for-x86_64-appstream-rpms 109 M

RHEL 10 (dnf-4.19.0-2.el10.noarch) is affected.
Expected results:
Upgrading:
firefox x86_64 78.3.0-1.el8_2 rhel-8-for-x86_64-appstream-rpms 105 M

Additional info: