Language: Python
Label: safe
CWE: CWE-521 \u2014 Weak Password Requirements
The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.

Code:
    def clean(self):
        super().clean()
        if self.errors:
            return self.cleaned_data
        oldpassword = self.cleaned_data.get("oldpassword")
        newpassword = self.cleaned_data.get("newpassword")
        confirmation = self.cleaned_data.get("confirmation")
        if newpassword and confirmation:
            if oldpassword:
                if newpassword != confirmation:
                    self.add_error("confirmation", _("Passwords mismatch"))
                else:
                    password_validation.validate_password(
                        confirmation, self.instance)
            else:
                self.add_error("oldpassword", _("This field is required."))
        elif newpassword or confirmation:
            if not confirmation:
                self.add_error("confirmation", _("This field is required."))
            else:
                self.add_error("newpassword", _("This field is required."))
        return self.cleaned_data