A Linux distribution may ship one major software version for the life of an operating-system release. Instead of replacing it with every new upstream version, its maintainers can take the relevant security change and apply it to that older codebase. This limits unrelated compatibility changes.
Backporting explains why a patched package can still display a version that vulnerability scanners associate with an old upstream release. The fix may be recorded in the distributor's package release number, security advisory or changelog rather than in the software's own banner.
Backports require trust in the particular vendor and package. An arbitrary old build is not safe merely because that vendor sometimes backports. Nor does a backport imply every newer feature or nonsecurity bug fix was included.
Check the vendor's advisory for the exact vulnerability and installed package identifier. Prefer packages from the supported update channel and document the evidence when a version-only scanner flags the system.