Is media-7.x-1.x vulnerable to SA-CONTRIB-2018-020
According to Joseph Olstad 1.x is not vulnerable to the problem found in the 2.x branch. Source:
https://www.drupal.org/project/media/issues/2966112#comment-12592407

There is a previously unreleased fix for another security issue though. This was integrated in version 1.7 of this module.