In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers (in the vmware.py files) does not always validate the SSL/TLS certificate.
https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html
https://security.gentoo.org/glsa/202103-01