A single CVE advisory can impact many packages.
There is not always a one-on-one mapping of a CVE to a Red Hat Security Advisory (RHSA).
There can be a one-to-many mapping from a specific CVE to different RHSA's in which the CVE is addressed. Some RHSA's also combine the fixes for two or more CVE's, bugs and/or enhancements in a single update.
A single Red Hat Security Advisory (RHSA) can consist many different RPM packages as well.
You will almost always see that a single RHSA includes at least two updated packages, an updated source RPM (SRPM) package and an updated binary RPM package and often (many) more:
Some products are split up in several RPM packages, typically a main RPM and several optional components which are shipped in separate, but related RPM packages. When a vulnerability impacts such a product often there will be more than 2 new packages that have been released.
Many RHSA's apply to several different architectures at once. The same bug applies and the fix is released by compiling the same updated SRPM package(s) to different binary RPM's for the different supported architectures (x86_64, IBM z Systems , Power and ARM).
For the inverse relationship: each updated RPM/SRPM package is only ever part of one Security/Enhancement/Bug-fix Advisory (RHSA, RHEA or RHBA).
As an example: CVE-2021-44228 ; the recent big log4j vulnerability.
A nice overview of all RHSA's that were created to address that is found on:
For the single product "Red Hat OpenShift 4" the following list of RHSA's was created :
RHSA-2022:5821 is an example that combines the fixes for several CVE's in a single update (4 CVE's, 4 bug fixes and a product enhancement). That results in 20 updated SRPM's and over updated 200 RPM packages.
Apache httpd is a good example of a single product that is split in several related RPM's and which released on several different architectures (x86_64, IBM z Systems , Power and ARM)
RHSA-2022:5163 shows for x86_64 RHEL 8 alone a whole host of updated packages (and many more when taking all other architectures into account):
3 new SRPM's:
20 new x86_64 RPM's:
Most systems won't have all of those installed and the number RPM packages that actually needed to be installed/updated to address CVE-2020-13950 would have been quite a bit lower.