Description of problem:
The yum in RHEL-5 (not 100% sure about RHEL-6) just takes the epoch values as given, so:
<package arch="x86_64" epoch="None" name="sslscan" release="3.el5" src="
...only matches to packages which have epoch="None" (or higher).
Version-Release number of selected component (if applicable):
This issue should be resolved with the latest version of bodhi in production (v0.8.0).
Actually, I still see epoch="None" in the current updateinfo, which could be due to old cached metadata. I just cleaned it out, so I'm going to re-open this ticket until I can confirm that they are gone.
This issue has been resolved.