Is media-7.x-1.x vulnerable to SA-CONTRIB-2018-020 The Drupal Media module version 7.x-2.x contains a remote code execution vulnerability which was patched with:

https://cgit.drupalcode.org/media/commit/?id=1cd77ffa9c2cf96d80b76d47318179a8a82f0d46

1.x and 2.x seem to be very different beasts, I can't find any corresponding code to media_ajax_upload() in 1.x but I'm still rather unsure wether this version is vulnerable or not.
According to Joseph Olstad 1.x is not vulnerable to the problem found in the 2.x branch. Source:
https://www.drupal.org/project/media/issues/2966112#comment-12592407

There is a previously unreleased fix for another security issue though. This was integrated in version 1.7 of this module.