Apache cxf 2.4.9 has a compile time dependency on org.apache.security.ws:wss4j 1.6.7. Since Apache cxf 2.4.9 is already included in AS 7, it seems to make sense to upgrade wss4j to avoid possible problems with cxf 2.4.9.
The webservices testsuite has been verified to work with the wss4j upgrade.