We need to upgrade Mojarra to 2.1.28-jbossorg-3 to resolve the linked bug.
The source for the 2.1.28-jbossorg-3 version of jsf-impl is available here:
Removing 6.4.0 target, there's a bz for 6.4.0: https://bugzilla.redhat.com/show_bug.cgi?id=1118024
The version of jsf-impl jar file which is in EAP 6.3.1.CP.CR1 is 2.1.28-redhat-5 (not 2.1.28-redhat-4).
However, it contains the patched Mojarra 2.1.28-jbossorg-3, so marking as verified.