The scenario:

use jbossws-cxf-client dependency and check dependency-tree:
http://jenkins.mw.lab.eng.bos.redhat.com/hudson/view/EAP7/view/EAP7-WS/job/eap-7x-jbossws-cxf-client-dep-tree/25/

As I understand, there was a move from com.sun.xml.bind:jaxb* to org.glassfish:jaxb*, so I suppose we should NOT have com.sun.xml.bind:jaxb* in dependency tree. NOTE: some work has been done in JBEAP-2620, where sun dependencies were replaced for glassfish ones via dependencyManagement but that doesn't seem to work for productized CXF artifacts.

   |  +- com.sun.xml.bind:jaxb-xjc:jar:2.2.11:compile
   |  +- com.sun.xml.bind:jaxb-core:jar:2.2.11:compile
   |  \- com.sun.xml.bind:jaxb-impl:jar:2.2.11:compile

See whole verbose dependency tree http://jenkins.mw.lab.eng.bos.redhat.com/hudson/view/EAP7/view/EAP7-WS/job/eap-7x-jbossws-cxf-client-dep-tree/25/artifact/jbossqe-eap-tests-ws/jbossws-cxf-client/dependency-tree-5.1.2.Final-redhat-2-using-BOM-verbose.txt