If configured with SSLVerifyClient set to 1 or 3 and SSLFakeBasicAuth, Apache-SSL 1.3.28+1.52 and all earlier versions would permit a client to use real basic authentication to forge a client certificate.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/32641/ApacheSSLvuln.txt
Source: https://packetstormsecurity.com/files/32641/ApacheSSLvuln.txt.html